@code-yeongyu/senpi 2026.9.3 → 2026.9.4-2

package/dist/core/extensions/builtin/claude-sdk-oauth/auth-lane.js

@@ -8,11 +8,14 @@ import { selectAccount } from "./affinity.js";
 import { createAttemptMessages } from "./auth-attempt.js";
 import { hasRequestOauthToken, mergeRequestAuthEnvironment, stripManagedAuthEnvironment } from "./auth-environment.js";
 import { writeConfigDirCredential } from "./config-dir-credentials.js";
-import { classifySdkError } from "./errors.js";
+import { classifySdkError, sdkAssistantFailure, sdkResultFailure } from "./errors.js";
 import { runFailover } from "./failover.js";
 import { refusalError } from "./refusal.js";
 export { CLAUDE_SDK_OAUTH_PROVIDER_ID } from "./account-management.js";
 export const EXPIRING_WITHIN_MS = 5 * 60_000;
+/** A managed lane with an empty pool must refuse rather than spawn the SDK against ambient host credentials. */
+const NO_MANAGED_ACCOUNTS_ERROR = "authentication_failed: No Claude SDK OAuth accounts configured for the managed lane; " +
+    "run /login claude-sdk-oauth or set CLAUDE_CODE_OAUTH_TOKEN";
 async function refreshWithAnthropicOAuth(refresh, signal) {
     const oauth = await loadAnthropicOAuth();
     const credential = await oauth.refresh({ type: "oauth", access: "", refresh, expires: 0 }, signal);
@@ -46,8 +49,10 @@ async function managedPool(settings, requestEnvironment) {
     }
     const configuredLane = resolveEffectiveLane(settings, accounts);
     const lane = configuredLane === "config-dir" && hasRequestOauthToken(requestEnvironment) ? "oauth-slots" : configuredLane;
-    if (lane === "ambient" || accounts.length === 0)
+    if (lane === "ambient")
         return undefined;
+    if (accounts.length === 0)
+        throw new Error(NO_MANAGED_ACCOUNTS_ERROR);
     const stored = credential?.type === "oauth" ? credential : undefined;
     return { accounts, environment, lane, pinnedAccount: settings.pinnedAccount ?? stored?.pinned, store };
 }
@@ -65,7 +70,10 @@ async function prepareSlot(pool, selected, signal) {
         }
         catch (error) {
             const detail = error instanceof Error ? error.message : String(error);
-            throw new Error(`authentication_failed: ${detail}`);
+            const classification = classifySdkError(detail);
+            throw new Error(classification.kind === "other" && classification.retryable
+                ? `server_error: ${detail}`
+                : `authentication_failed: ${detail}`);
         }
     }
     const access = slot.source === "env" ? envSlotToken((name) => environment[name], slot.name) : slot.access;
@@ -81,21 +89,10 @@ function sdkFailure(message) {
     const refusal = refusalError(message);
     if (refusal)
         return refusal;
-    if (message.type === "assistant" && message.error)
-        return message.error;
-    if (message.type === "result" && message.subtype !== "success") {
-        const errors = "errors" in message && Array.isArray(message.errors) ? message.errors : [];
-        if (errors.length > 0)
-            return new Error(String(errors[0]));
-        // `subtype` alone is too coarse to classify: a subscription limit and an
-        // ordinary tool failure both arrive as "error_during_execution". The SDK
-        // carries the real cause in `terminal_reason` (e.g. "blocking_limit"), so
-        // append it — otherwise classifySdkError() scores every result error as
-        // non-retryable "other", the exhausted account is never blocked, and a
-        // multi-account pool never rotates past it.
-        const reason = "terminal_reason" in message && typeof message.terminal_reason === "string" ? message.terminal_reason : "";
-        return new Error(reason ? `Claude Code ${message.subtype}: ${reason}` : `Claude Code ${message.subtype}`);
-    }
+    if (message.type === "assistant")
+        return sdkAssistantFailure(message);
+    if (message.type === "result")
+        return sdkResultFailure(message);
     return undefined;
 }
 function visibleSdkMessage(message) {

package/dist/core/extensions/builtin/claude-sdk-oauth/auth-lane.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-lane.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/auth-lane.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAGN,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,WAAW,GAEX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAkC,qBAAqB,EAA0B,MAAM,mBAAmB,CAAC;AAClH,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACvH,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAI5C,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AAU7C,KAAK,UAAU,yBAAyB,CAAC,OAAe,EAAE,MAAmB;IAC5E,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACnG,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;AAChG,CAAC;AAED,MAAM,eAAe,GAAqB;IACzC,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE;IACvC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG;IACtB,WAAW;IACX,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,SAAS,EAAE,yBAAyB;CACpC,CAAC;AACF,IAAI,cAAc,GAAG,eAAe,CAAC;AAErC,MAAM,UAAU,wBAAwB,CAAC,QAAmC;IAC3E,cAAc,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,QAAQ,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACpC,cAAc,GAAG,eAAe,CAAC;AAClC,CAAC;AA6BD,MAAM,UAAU,oBAAoB,CACnC,QAAwC,EACxC,QAAgC;IAEhC,OAAO,QAAQ,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,QAAwC,EACxC,kBAA2C;IAE3C,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,2BAA2B,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC1F,IAAI,QAAQ,GAAG,YAAY,CACzB,UAAmD,IAAI,eAAe,EAAE,EACzE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAC3B,CAAC;IACF,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;QAC7F,QAAQ,GAAG,YAAY,CACrB,UAAuC,IAAI,eAAe,EAAE,EAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAC3B,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,IAAI,GACT,cAAc,KAAK,YAAY,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;IAC9G,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAG,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAE,UAAuC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACxG,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,IAAiB,EACjB,QAAqB,EACrB,MAAmB;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC;IACtB,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACxF,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,WAAW,CAClC,IAAI,CAAC,KAAK,EACV,4BAA4B,EAC5B,IAAI,CAAC,IAAI,EACT,cAAc,CAAC,SAAS,EACxB,MAAM,EACN,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,OAAO,GAAG,kBAAkB,CACjE,CAAC;YACF,MAAM,UAAU,GAAG,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAE,SAAsC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrG,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,IAAI,eAAe,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAC9F,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAC3C,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC7E,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,EAAE,GAAG,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC;IACjG,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvF,OAAO,EAAE,GAAG,gBAAgB,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,OAAmB;IACtC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxE,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,MAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,4CAA4C;QAC5C,MAAM,MAAM,GACX,iBAAiB,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAmB;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,iBAAiB,CAAC,KAA8B;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACvF,MAAM,kBAAkB,GAAuC,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACxF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,kBAAkB,CAAC;QACjC,KAAK,CAAC,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE;YACzC,WAAW,EAAE,SAAS;YACtB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,OAAO;SACP,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IACD,KAAK,CAAC,CAAC,WAAW,CAAC;QAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACtB,aAAa,CAAC,QAAQ,EAAE;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa;YACxD,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE;SACzB,CAAC;QACH,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACpD,OAAO,qBAAqB,CAAC,KAAK,EAAE;gBACnC,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,OAAO;aACP,CAAC,CAAC;QACJ,CAAC;QACD,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,4BAA4B;QACxC,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,cAAc,EAAE,UAAU;QAC1B,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE;YACxD,2BAA2B,CAAC,4BAA4B,CAAC,CAAC;YAC1D,IAAI,WAAW,EAAE,CAAC;gBACjB,2BAA2B,CAC1B,4BAA4B,EAC5B,OAAO,CAAC,IAAI,EACZ,WAAW,CAAC,IAAI,EAChB,cAAc,CAAC,IAAI,CACnB,CAAC;YACH,CAAC;QACF,CAAC;KACD,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { CredentialStore } from \"@earendil-works/pi-ai\";\nimport { loadAnthropicOAuth } from \"@earendil-works/pi-ai/oauth\";\nimport { getAgentDir } from \"../../../../config.ts\";\nimport { AuthStorage } from \"../../../auth-storage.ts\";\nimport { emitProviderAccountFailover, emitProviderAccountsChanged } from \"./account-events.ts\";\nimport { CLAUDE_SDK_OAUTH_PROVIDER_ID } from \"./account-management.ts\";\nimport {\n\ttype AccountSlot,\n\ttype ClaudeSdkOauthCredential,\n\temptyCredential,\n\tenvSlotToken,\n\tlistAccounts,\n\trefreshSlot,\n\ttype SlotRefresher,\n} from \"./accounts.ts\";\nimport { selectAccount } from \"./affinity.ts\";\nimport { type AuthenticatedAttemptInput, createAttemptMessages, type RetainableAttempt } from \"./auth-attempt.ts\";\nimport { hasRequestOauthToken, mergeRequestAuthEnvironment, stripManagedAuthEnvironment } from \"./auth-environment.ts\";\nimport { writeConfigDirCredential } from \"./config-dir-credentials.ts\";\nimport { classifySdkError } from \"./errors.ts\";\nimport { runFailover } from \"./failover.ts\";\nimport { refusalError } from \"./refusal.ts\";\nimport type { Options, SDKMessage, SdkQuery } from \"./sdk-boundary.ts\";\nimport type { ClaudeSdkOauthProviderSettings, ClaudeSdkOauthTokenInjection } from \"./settings.ts\";\n\nexport { CLAUDE_SDK_OAUTH_PROVIDER_ID } from \"./account-management.ts\";\n\nexport const EXPIRING_WITHIN_MS = 5 * 60_000;\n\ntype AuthLaneBoundary = {\n\tcreateStore: () => CredentialStore;\n\tenv: () => NodeJS.ProcessEnv;\n\tgetAgentDir: () => string;\n\tnow: () => number;\n\trefresher: SlotRefresher;\n};\n\nasync function refreshWithAnthropicOAuth(refresh: string, signal: AbortSignal) {\n\tconst oauth = await loadAnthropicOAuth();\n\tconst credential = await oauth.refresh({ type: \"oauth\", access: \"\", refresh, expires: 0 }, signal);\n\treturn { access: credential.access, refresh: credential.refresh, expires: credential.expires };\n}\n\nconst defaultBoundary: AuthLaneBoundary = {\n\tcreateStore: () => AuthStorage.create(),\n\tenv: () => process.env,\n\tgetAgentDir,\n\tnow: () => Date.now(),\n\trefresher: refreshWithAnthropicOAuth,\n};\nlet activeBoundary = defaultBoundary;\n\nexport function overrideAuthLaneBoundary(override: Partial<AuthLaneBoundary>): void {\n\tactiveBoundary = { ...activeBoundary, ...override };\n}\n\nexport function resetAuthLaneBoundary(): void {\n\tactiveBoundary = defaultBoundary;\n}\n\nexport type { AuthenticatedAttemptInput } from \"./auth-attempt.ts\";\n\nexport type AuthenticatedQueryInput = {\n\tprompt: Parameters<SdkQuery>[0][\"prompt\"];\n\tquery: SdkQuery;\n\tbuildOptions: (lane: ClaudeSdkOauthTokenInjection) => Options;\n\tproviderSettings: ClaudeSdkOauthProviderSettings;\n\t/** Effective request auth environment; overrides the host for account discovery and SDK spawn. */\n\tenv?: Record<string, string>;\n\tsignal?: AbortSignal;\n\tsessionId?: string;\n\t/** Request-scoped CLI pin; takes precedence over persistent settings and account pins. */\n\tpinnedAccount?: string;\n\tonQuery?: (query: ReturnType<SdkQuery>) => void;\n\tcreateAttempt?: (\n\t\tinput: AuthenticatedAttemptInput,\n\t) => RetainableAttempt<SDKMessage> | Promise<RetainableAttempt<SDKMessage>>;\n};\n\ntype ManagedPool = {\n\taccounts: AccountSlot[];\n\tenvironment: NodeJS.ProcessEnv;\n\tlane: Exclude<ClaudeSdkOauthTokenInjection, \"ambient\">;\n\tpinnedAccount?: string;\n\tstore: CredentialStore;\n};\n\nexport function resolveEffectiveLane(\n\tsettings: ClaudeSdkOauthProviderSettings,\n\taccounts: readonly AccountSlot[],\n): ClaudeSdkOauthTokenInjection {\n\treturn settings.tokenInjection ?? (accounts.length > 0 ? \"oauth-slots\" : \"ambient\");\n}\n\nasync function managedPool(\n\tsettings: ClaudeSdkOauthProviderSettings,\n\trequestEnvironment?: Record<string, string>,\n): Promise<ManagedPool | undefined> {\n\tconst store = activeBoundary.createStore();\n\tlet credential = await store.read(CLAUDE_SDK_OAUTH_PROVIDER_ID);\n\tconst environment = mergeRequestAuthEnvironment(activeBoundary.env(), requestEnvironment);\n\tlet accounts = listAccounts(\n\t\t(credential as ClaudeSdkOauthCredential | undefined) ?? emptyCredential(),\n\t\t(name) => environment[name],\n\t);\n\tif (!credential && accounts.length > 0) {\n\t\tcredential = await store.modify(CLAUDE_SDK_OAUTH_PROVIDER_ID, async () => emptyCredential());\n\t\taccounts = listAccounts(\n\t\t\t(credential as ClaudeSdkOauthCredential) ?? emptyCredential(),\n\t\t\t(name) => environment[name],\n\t\t);\n\t}\n\tconst configuredLane = resolveEffectiveLane(settings, accounts);\n\tconst lane =\n\t\tconfiguredLane === \"config-dir\" && hasRequestOauthToken(requestEnvironment) ? \"oauth-slots\" : configuredLane;\n\tif (lane === \"ambient\" || accounts.length === 0) return undefined;\n\tconst stored = credential?.type === \"oauth\" ? (credential as ClaudeSdkOauthCredential) : undefined;\n\treturn { accounts, environment, lane, pinnedAccount: settings.pinnedAccount ?? stored?.pinned, store };\n}\n\nasync function prepareSlot(\n\tpool: ManagedPool,\n\tselected: AccountSlot,\n\tsignal: AbortSignal,\n): Promise<Record<string, string | undefined>> {\n\tconst environment = pool.environment;\n\tconst slot = selected;\n\tif (slot.source !== \"env\" && activeBoundary.now() >= slot.expires - EXPIRING_WITHIN_MS) {\n\t\ttry {\n\t\t\tconst refreshed = await refreshSlot(\n\t\t\t\tpool.store,\n\t\t\t\tCLAUDE_SDK_OAUTH_PROVIDER_ID,\n\t\t\t\tslot.name,\n\t\t\t\tactiveBoundary.refresher,\n\t\t\t\tsignal,\n\t\t\t\t(expires) => activeBoundary.now() >= expires - EXPIRING_WITHIN_MS,\n\t\t\t);\n\t\t\tconst credential = refreshed?.type === \"oauth\" ? (refreshed as ClaudeSdkOauthCredential) : undefined;\n\t\t\tconst updated = listAccounts(credential ?? emptyCredential(), (name) => environment[name]).find(\n\t\t\t\t(candidate) => candidate.name === slot.name,\n\t\t\t);\n\t\t\tif (!updated) throw new Error(\"selected account disappeared during refresh\");\n\t\t\tObject.assign(slot, updated);\n\t\t} catch (error) {\n\t\t\tconst detail = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`authentication_failed: ${detail}`);\n\t\t}\n\t}\n\tconst access = slot.source === \"env\" ? envSlotToken((name) => environment[name], slot.name) : slot.access;\n\tif (!access) throw new Error(\"authentication_failed: selected OAuth token is unavailable\");\n\tconst childEnvironment = stripManagedAuthEnvironment(environment);\n\tif (pool.lane === \"oauth-slots\") return { ...childEnvironment, CLAUDE_CODE_OAUTH_TOKEN: access };\n\tconst directory = writeConfigDirCredential(activeBoundary.getAgentDir(), slot, access);\n\treturn { ...childEnvironment, CLAUDE_CONFIG_DIR: directory };\n}\n\nfunction sdkFailure(message: SDKMessage): unknown | undefined {\n\tconst refusal = refusalError(message);\n\tif (refusal) return refusal;\n\tif (message.type === \"assistant\" && message.error) return message.error;\n\tif (message.type === \"result\" && message.subtype !== \"success\") {\n\t\tconst errors = \"errors\" in message && Array.isArray(message.errors) ? (message.errors as unknown[]) : [];\n\t\tif (errors.length > 0) return new Error(String(errors[0]));\n\t\t// `subtype` alone is too coarse to classify: a subscription limit and an\n\t\t// ordinary tool failure both arrive as \"error_during_execution\". The SDK\n\t\t// carries the real cause in `terminal_reason` (e.g. \"blocking_limit\"), so\n\t\t// append it — otherwise classifySdkError() scores every result error as\n\t\t// non-retryable \"other\", the exhausted account is never blocked, and a\n\t\t// multi-account pool never rotates past it.\n\t\tconst reason =\n\t\t\t\"terminal_reason\" in message && typeof message.terminal_reason === \"string\" ? message.terminal_reason : \"\";\n\t\treturn new Error(reason ? `Claude Code ${message.subtype}: ${reason}` : `Claude Code ${message.subtype}`);\n\t}\n\treturn undefined;\n}\n\nfunction visibleSdkMessage(message: SDKMessage): boolean {\n\tif (message.type !== \"stream_event\") return false;\n\treturn /^(?:content_block_start|content_block_delta|content_block_stop)$/.test(message.event.type);\n}\n\n/** Resolves managed OAuth immediately before each subprocess spawn and retries only pre-delta failures. */\nexport async function* queryWithAuthLane(input: AuthenticatedQueryInput): AsyncGenerator<SDKMessage> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst pool = await managedPool(input.providerSettings, input.env);\n\tif (!pool) {\n\t\tconst options = input.buildOptions(\"ambient\");\n\t\tconst parentEnvironment = mergeRequestAuthEnvironment(activeBoundary.env(), input.env);\n\t\tconst ambientEnvironment: Record<string, string | undefined> = { ...parentEnvironment };\n\t\tfor (const name of Object.keys(ambientEnvironment)) {\n\t\t\tif (name.startsWith(\"SENPI_\")) delete ambientEnvironment[name];\n\t\t}\n\t\toptions.env = ambientEnvironment;\n\t\tyield* await createAttemptMessages(input, {\n\t\t\taccountName: \"ambient\",\n\t\t\taccounts: [],\n\t\t\tauthLane: \"ambient\",\n\t\t\toptions,\n\t\t});\n\t\treturn;\n\t}\n\tyield* runFailover({\n\t\taccounts: pool.accounts,\n\t\tselectFn: (accounts) =>\n\t\t\tselectAccount(accounts, {\n\t\t\t\tsessionId: input.sessionId,\n\t\t\t\tpinnedAccount: input.pinnedAccount ?? pool.pinnedAccount,\n\t\t\t\tnow: activeBoundary.now(),\n\t\t\t}),\n\t\trunAttempt: async (slot) => {\n\t\t\tconst options = input.buildOptions(pool.lane);\n\t\t\tconst accounts = pool.accounts.map((account) => ({ ...account }));\n\t\t\toptions.env = await prepareSlot(pool, slot, signal);\n\t\t\treturn createAttemptMessages(input, {\n\t\t\t\taccountName: slot.name,\n\t\t\t\taccounts,\n\t\t\t\tauthLane: pool.lane,\n\t\t\t\toptions,\n\t\t\t});\n\t\t},\n\t\tclassify: classifySdkError,\n\t\tstore: pool.store,\n\t\tproviderId: CLAUDE_SDK_OAUTH_PROVIDER_ID,\n\t\tnow: activeBoundary.now,\n\t\terrorFromEvent: sdkFailure,\n\t\tisVisibleDelta: visibleSdkMessage,\n\t\tonFailover: ({ account, nextAccount, classification }) => {\n\t\t\temitProviderAccountsChanged(CLAUDE_SDK_OAUTH_PROVIDER_ID);\n\t\t\tif (nextAccount) {\n\t\t\t\temitProviderAccountFailover(\n\t\t\t\t\tCLAUDE_SDK_OAUTH_PROVIDER_ID,\n\t\t\t\t\taccount.name,\n\t\t\t\t\tnextAccount.name,\n\t\t\t\t\tclassification.kind,\n\t\t\t\t);\n\t\t\t}\n\t\t},\n\t});\n}\n"]}
+{"version":3,"file":"auth-lane.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/auth-lane.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAGN,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,WAAW,GAEX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAkC,qBAAqB,EAA0B,MAAM,mBAAmB,CAAC;AAClH,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACvH,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAI5C,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AAE7C,gHAAgH;AAChH,MAAM,yBAAyB,GAC9B,uFAAuF;IACvF,4DAA4D,CAAC;AAU9D,KAAK,UAAU,yBAAyB,CAAC,OAAe,EAAE,MAAmB;IAC5E,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACnG,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;AAChG,CAAC;AAED,MAAM,eAAe,GAAqB;IACzC,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE;IACvC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG;IACtB,WAAW;IACX,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,SAAS,EAAE,yBAAyB;CACpC,CAAC;AACF,IAAI,cAAc,GAAG,eAAe,CAAC;AAErC,MAAM,UAAU,wBAAwB,CAAC,QAAmC;IAC3E,cAAc,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,QAAQ,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACpC,cAAc,GAAG,eAAe,CAAC;AAClC,CAAC;AA6BD,MAAM,UAAU,oBAAoB,CACnC,QAAwC,EACxC,QAAgC;IAEhC,OAAO,QAAQ,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,QAAwC,EACxC,kBAA2C;IAE3C,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,2BAA2B,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC1F,IAAI,QAAQ,GAAG,YAAY,CACzB,UAAmD,IAAI,eAAe,EAAE,EACzE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAC3B,CAAC;IACF,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;QAC7F,QAAQ,GAAG,YAAY,CACrB,UAAuC,IAAI,eAAe,EAAE,EAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAC3B,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChE,MAAM,IAAI,GACT,cAAc,KAAK,YAAY,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC;IAC9G,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAE,UAAuC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACxG,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,IAAiB,EACjB,QAAqB,EACrB,MAAmB;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC;IACtB,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACxF,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,WAAW,CAClC,IAAI,CAAC,KAAK,EACV,4BAA4B,EAC5B,IAAI,CAAC,IAAI,EACT,cAAc,CAAC,SAAS,EACxB,MAAM,EACN,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,OAAO,GAAG,kBAAkB,CACjE,CAAC;YACF,MAAM,UAAU,GAAG,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAE,SAAsC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrG,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,IAAI,eAAe,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAC9F,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAC3C,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC7E,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CACd,cAAc,CAAC,IAAI,KAAK,OAAO,IAAI,cAAc,CAAC,SAAS;gBAC1D,CAAC,CAAC,iBAAiB,MAAM,EAAE;gBAC3B,CAAC,CAAC,0BAA0B,MAAM,EAAE,CACrC,CAAC;QACH,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,EAAE,GAAG,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC;IACjG,MAAM,SAAS,GAAG,wBAAwB,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACvF,OAAO,EAAE,GAAG,gBAAgB,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,OAAmB;IACtC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAChE,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAmB;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,iBAAiB,CAAC,KAA8B;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACvF,MAAM,kBAAkB,GAAuC,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACxF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,kBAAkB,CAAC;QACjC,KAAK,CAAC,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE;YACzC,WAAW,EAAE,SAAS;YACtB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,SAAS;YACnB,OAAO;SACP,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IACD,KAAK,CAAC,CAAC,WAAW,CAAC;QAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACtB,aAAa,CAAC,QAAQ,EAAE;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa;YACxD,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE;SACzB,CAAC;QACH,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACpD,OAAO,qBAAqB,CAAC,KAAK,EAAE;gBACnC,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,OAAO;aACP,CAAC,CAAC;QACJ,CAAC;QACD,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,4BAA4B;QACxC,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,cAAc,EAAE,UAAU;QAC1B,cAAc,EAAE,iBAAiB;QACjC,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,EAAE;YACxD,2BAA2B,CAAC,4BAA4B,CAAC,CAAC;YAC1D,IAAI,WAAW,EAAE,CAAC;gBACjB,2BAA2B,CAC1B,4BAA4B,EAC5B,OAAO,CAAC,IAAI,EACZ,WAAW,CAAC,IAAI,EAChB,cAAc,CAAC,IAAI,CACnB,CAAC;YACH,CAAC;QACF,CAAC;KACD,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { CredentialStore } from \"@earendil-works/pi-ai\";\nimport { loadAnthropicOAuth } from \"@earendil-works/pi-ai/oauth\";\nimport { getAgentDir } from \"../../../../config.ts\";\nimport { AuthStorage } from \"../../../auth-storage.ts\";\nimport { emitProviderAccountFailover, emitProviderAccountsChanged } from \"./account-events.ts\";\nimport { CLAUDE_SDK_OAUTH_PROVIDER_ID } from \"./account-management.ts\";\nimport {\n\ttype AccountSlot,\n\ttype ClaudeSdkOauthCredential,\n\temptyCredential,\n\tenvSlotToken,\n\tlistAccounts,\n\trefreshSlot,\n\ttype SlotRefresher,\n} from \"./accounts.ts\";\nimport { selectAccount } from \"./affinity.ts\";\nimport { type AuthenticatedAttemptInput, createAttemptMessages, type RetainableAttempt } from \"./auth-attempt.ts\";\nimport { hasRequestOauthToken, mergeRequestAuthEnvironment, stripManagedAuthEnvironment } from \"./auth-environment.ts\";\nimport { writeConfigDirCredential } from \"./config-dir-credentials.ts\";\nimport { classifySdkError, sdkAssistantFailure, sdkResultFailure } from \"./errors.ts\";\nimport { runFailover } from \"./failover.ts\";\nimport { refusalError } from \"./refusal.ts\";\nimport type { Options, SDKMessage, SdkQuery } from \"./sdk-boundary.ts\";\nimport type { ClaudeSdkOauthProviderSettings, ClaudeSdkOauthTokenInjection } from \"./settings.ts\";\n\nexport { CLAUDE_SDK_OAUTH_PROVIDER_ID } from \"./account-management.ts\";\n\nexport const EXPIRING_WITHIN_MS = 5 * 60_000;\n\n/** A managed lane with an empty pool must refuse rather than spawn the SDK against ambient host credentials. */\nconst NO_MANAGED_ACCOUNTS_ERROR =\n\t\"authentication_failed: No Claude SDK OAuth accounts configured for the managed lane; \" +\n\t\"run /login claude-sdk-oauth or set CLAUDE_CODE_OAUTH_TOKEN\";\n\ntype AuthLaneBoundary = {\n\tcreateStore: () => CredentialStore;\n\tenv: () => NodeJS.ProcessEnv;\n\tgetAgentDir: () => string;\n\tnow: () => number;\n\trefresher: SlotRefresher;\n};\n\nasync function refreshWithAnthropicOAuth(refresh: string, signal: AbortSignal) {\n\tconst oauth = await loadAnthropicOAuth();\n\tconst credential = await oauth.refresh({ type: \"oauth\", access: \"\", refresh, expires: 0 }, signal);\n\treturn { access: credential.access, refresh: credential.refresh, expires: credential.expires };\n}\n\nconst defaultBoundary: AuthLaneBoundary = {\n\tcreateStore: () => AuthStorage.create(),\n\tenv: () => process.env,\n\tgetAgentDir,\n\tnow: () => Date.now(),\n\trefresher: refreshWithAnthropicOAuth,\n};\nlet activeBoundary = defaultBoundary;\n\nexport function overrideAuthLaneBoundary(override: Partial<AuthLaneBoundary>): void {\n\tactiveBoundary = { ...activeBoundary, ...override };\n}\n\nexport function resetAuthLaneBoundary(): void {\n\tactiveBoundary = defaultBoundary;\n}\n\nexport type { AuthenticatedAttemptInput } from \"./auth-attempt.ts\";\n\nexport type AuthenticatedQueryInput = {\n\tprompt: Parameters<SdkQuery>[0][\"prompt\"];\n\tquery: SdkQuery;\n\tbuildOptions: (lane: ClaudeSdkOauthTokenInjection) => Options;\n\tproviderSettings: ClaudeSdkOauthProviderSettings;\n\t/** Effective request auth environment; overrides the host for account discovery and SDK spawn. */\n\tenv?: Record<string, string>;\n\tsignal?: AbortSignal;\n\tsessionId?: string;\n\t/** Request-scoped CLI pin; takes precedence over persistent settings and account pins. */\n\tpinnedAccount?: string;\n\tonQuery?: (query: ReturnType<SdkQuery>) => void;\n\tcreateAttempt?: (\n\t\tinput: AuthenticatedAttemptInput,\n\t) => RetainableAttempt<SDKMessage> | Promise<RetainableAttempt<SDKMessage>>;\n};\n\ntype ManagedPool = {\n\taccounts: AccountSlot[];\n\tenvironment: NodeJS.ProcessEnv;\n\tlane: Exclude<ClaudeSdkOauthTokenInjection, \"ambient\">;\n\tpinnedAccount?: string;\n\tstore: CredentialStore;\n};\n\nexport function resolveEffectiveLane(\n\tsettings: ClaudeSdkOauthProviderSettings,\n\taccounts: readonly AccountSlot[],\n): ClaudeSdkOauthTokenInjection {\n\treturn settings.tokenInjection ?? (accounts.length > 0 ? \"oauth-slots\" : \"ambient\");\n}\n\nasync function managedPool(\n\tsettings: ClaudeSdkOauthProviderSettings,\n\trequestEnvironment?: Record<string, string>,\n): Promise<ManagedPool | undefined> {\n\tconst store = activeBoundary.createStore();\n\tlet credential = await store.read(CLAUDE_SDK_OAUTH_PROVIDER_ID);\n\tconst environment = mergeRequestAuthEnvironment(activeBoundary.env(), requestEnvironment);\n\tlet accounts = listAccounts(\n\t\t(credential as ClaudeSdkOauthCredential | undefined) ?? emptyCredential(),\n\t\t(name) => environment[name],\n\t);\n\tif (!credential && accounts.length > 0) {\n\t\tcredential = await store.modify(CLAUDE_SDK_OAUTH_PROVIDER_ID, async () => emptyCredential());\n\t\taccounts = listAccounts(\n\t\t\t(credential as ClaudeSdkOauthCredential) ?? emptyCredential(),\n\t\t\t(name) => environment[name],\n\t\t);\n\t}\n\tconst configuredLane = resolveEffectiveLane(settings, accounts);\n\tconst lane =\n\t\tconfiguredLane === \"config-dir\" && hasRequestOauthToken(requestEnvironment) ? \"oauth-slots\" : configuredLane;\n\tif (lane === \"ambient\") return undefined;\n\tif (accounts.length === 0) throw new Error(NO_MANAGED_ACCOUNTS_ERROR);\n\tconst stored = credential?.type === \"oauth\" ? (credential as ClaudeSdkOauthCredential) : undefined;\n\treturn { accounts, environment, lane, pinnedAccount: settings.pinnedAccount ?? stored?.pinned, store };\n}\n\nasync function prepareSlot(\n\tpool: ManagedPool,\n\tselected: AccountSlot,\n\tsignal: AbortSignal,\n): Promise<Record<string, string | undefined>> {\n\tconst environment = pool.environment;\n\tconst slot = selected;\n\tif (slot.source !== \"env\" && activeBoundary.now() >= slot.expires - EXPIRING_WITHIN_MS) {\n\t\ttry {\n\t\t\tconst refreshed = await refreshSlot(\n\t\t\t\tpool.store,\n\t\t\t\tCLAUDE_SDK_OAUTH_PROVIDER_ID,\n\t\t\t\tslot.name,\n\t\t\t\tactiveBoundary.refresher,\n\t\t\t\tsignal,\n\t\t\t\t(expires) => activeBoundary.now() >= expires - EXPIRING_WITHIN_MS,\n\t\t\t);\n\t\t\tconst credential = refreshed?.type === \"oauth\" ? (refreshed as ClaudeSdkOauthCredential) : undefined;\n\t\t\tconst updated = listAccounts(credential ?? emptyCredential(), (name) => environment[name]).find(\n\t\t\t\t(candidate) => candidate.name === slot.name,\n\t\t\t);\n\t\t\tif (!updated) throw new Error(\"selected account disappeared during refresh\");\n\t\t\tObject.assign(slot, updated);\n\t\t} catch (error) {\n\t\t\tconst detail = error instanceof Error ? error.message : String(error);\n\t\t\tconst classification = classifySdkError(detail);\n\t\t\tthrow new Error(\n\t\t\t\tclassification.kind === \"other\" && classification.retryable\n\t\t\t\t\t? `server_error: ${detail}`\n\t\t\t\t\t: `authentication_failed: ${detail}`,\n\t\t\t);\n\t\t}\n\t}\n\tconst access = slot.source === \"env\" ? envSlotToken((name) => environment[name], slot.name) : slot.access;\n\tif (!access) throw new Error(\"authentication_failed: selected OAuth token is unavailable\");\n\tconst childEnvironment = stripManagedAuthEnvironment(environment);\n\tif (pool.lane === \"oauth-slots\") return { ...childEnvironment, CLAUDE_CODE_OAUTH_TOKEN: access };\n\tconst directory = writeConfigDirCredential(activeBoundary.getAgentDir(), slot, access);\n\treturn { ...childEnvironment, CLAUDE_CONFIG_DIR: directory };\n}\n\nfunction sdkFailure(message: SDKMessage): unknown | undefined {\n\tconst refusal = refusalError(message);\n\tif (refusal) return refusal;\n\tif (message.type === \"assistant\") return sdkAssistantFailure(message);\n\tif (message.type === \"result\") return sdkResultFailure(message);\n\treturn undefined;\n}\n\nfunction visibleSdkMessage(message: SDKMessage): boolean {\n\tif (message.type !== \"stream_event\") return false;\n\treturn /^(?:content_block_start|content_block_delta|content_block_stop)$/.test(message.event.type);\n}\n\n/** Resolves managed OAuth immediately before each subprocess spawn and retries only pre-delta failures. */\nexport async function* queryWithAuthLane(input: AuthenticatedQueryInput): AsyncGenerator<SDKMessage> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst pool = await managedPool(input.providerSettings, input.env);\n\tif (!pool) {\n\t\tconst options = input.buildOptions(\"ambient\");\n\t\tconst parentEnvironment = mergeRequestAuthEnvironment(activeBoundary.env(), input.env);\n\t\tconst ambientEnvironment: Record<string, string | undefined> = { ...parentEnvironment };\n\t\tfor (const name of Object.keys(ambientEnvironment)) {\n\t\t\tif (name.startsWith(\"SENPI_\")) delete ambientEnvironment[name];\n\t\t}\n\t\toptions.env = ambientEnvironment;\n\t\tyield* await createAttemptMessages(input, {\n\t\t\taccountName: \"ambient\",\n\t\t\taccounts: [],\n\t\t\tauthLane: \"ambient\",\n\t\t\toptions,\n\t\t});\n\t\treturn;\n\t}\n\tyield* runFailover({\n\t\taccounts: pool.accounts,\n\t\tselectFn: (accounts) =>\n\t\t\tselectAccount(accounts, {\n\t\t\t\tsessionId: input.sessionId,\n\t\t\t\tpinnedAccount: input.pinnedAccount ?? pool.pinnedAccount,\n\t\t\t\tnow: activeBoundary.now(),\n\t\t\t}),\n\t\trunAttempt: async (slot) => {\n\t\t\tconst options = input.buildOptions(pool.lane);\n\t\t\tconst accounts = pool.accounts.map((account) => ({ ...account }));\n\t\t\toptions.env = await prepareSlot(pool, slot, signal);\n\t\t\treturn createAttemptMessages(input, {\n\t\t\t\taccountName: slot.name,\n\t\t\t\taccounts,\n\t\t\t\tauthLane: pool.lane,\n\t\t\t\toptions,\n\t\t\t});\n\t\t},\n\t\tclassify: classifySdkError,\n\t\tstore: pool.store,\n\t\tproviderId: CLAUDE_SDK_OAUTH_PROVIDER_ID,\n\t\tnow: activeBoundary.now,\n\t\terrorFromEvent: sdkFailure,\n\t\tisVisibleDelta: visibleSdkMessage,\n\t\tonFailover: ({ account, nextAccount, classification }) => {\n\t\t\temitProviderAccountsChanged(CLAUDE_SDK_OAUTH_PROVIDER_ID);\n\t\t\tif (nextAccount) {\n\t\t\t\temitProviderAccountFailover(\n\t\t\t\t\tCLAUDE_SDK_OAUTH_PROVIDER_ID,\n\t\t\t\t\taccount.name,\n\t\t\t\t\tnextAccount.name,\n\t\t\t\t\tclassification.kind,\n\t\t\t\t);\n\t\t\t}\n\t\t},\n\t});\n}\n"]}

package/dist/core/extensions/builtin/claude-sdk-oauth/content-blocks.d.ts

@@ -0,0 +1,3 @@
+import type { ContentBlockParam } from "./sdk-boundary.ts";
+export declare function appendSdkContentBlocks(blocks: ContentBlockParam[], content: string | readonly unknown[]): boolean;
+//# sourceMappingURL=content-blocks.d.ts.map

package/dist/core/extensions/builtin/claude-sdk-oauth/content-blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-blocks.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/content-blocks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAqB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAI9E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,OAAO,EAAE,GAAG,OAAO,CAWjH"}

package/dist/core/extensions/builtin/claude-sdk-oauth/content-blocks.js

@@ -0,0 +1,80 @@
+const IMAGE_MEDIA_TYPES = ["image/jpeg", "image/png", "image/gif", "image/webp"];
+export function appendSdkContentBlocks(blocks, content) {
+    if (typeof content === "string") {
+        if (content.length > 0)
+            blocks.push({ type: "text", text: content });
+        return content.trim().length > 0;
+    }
+    let hasText = false;
+    for (const entry of content) {
+        hasText = appendEntry(blocks, entry) || hasText;
+    }
+    return hasText;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function parseImageMediaType(value) {
+    for (const mediaType of IMAGE_MEDIA_TYPES) {
+        if (mediaType === value)
+            return mediaType;
+    }
+    return undefined;
+}
+function omittedPlaceholder(entry) {
+    if (isRecord(entry) && typeof entry.type === "string") {
+        if (entry.type === "image") {
+            const complete = typeof entry.mimeType === "string" && typeof entry.data === "string";
+            return complete
+                ? `[image block omitted: unsupported media type ${entry.mimeType}]`
+                : "[image block omitted: missing data]";
+        }
+        return `[unsupported content block omitted: ${entry.type}]`;
+    }
+    return "[unsupported content block omitted]";
+}
+function imageFromEntry(entry) {
+    if (typeof entry.mimeType !== "string" || typeof entry.data !== "string")
+        return undefined;
+    const mediaType = parseImageMediaType(entry.mimeType);
+    if (mediaType === undefined)
+        return undefined;
+    return {
+        type: "image",
+        source: {
+            type: "base64",
+            media_type: mediaType,
+            data: entry.data,
+        },
+    };
+}
+function appendEntry(blocks, entry) {
+    if (typeof entry === "string") {
+        blocks.push({ type: "text", text: entry });
+        return entry.trim().length > 0;
+    }
+    if (!isRecord(entry)) {
+        blocks.push({ type: "text", text: omittedPlaceholder(entry) });
+        return true;
+    }
+    if (entry.type === "text") {
+        if (typeof entry.text === "string") {
+            blocks.push({ type: "text", text: entry.text });
+            return entry.text.trim().length > 0;
+        }
+        blocks.push({ type: "text", text: omittedPlaceholder(entry) });
+        return true;
+    }
+    if (entry.type === "image") {
+        const image = imageFromEntry(entry);
+        if (image) {
+            blocks.push(image);
+            return false;
+        }
+        blocks.push({ type: "text", text: omittedPlaceholder(entry) });
+        return true;
+    }
+    blocks.push({ type: "text", text: omittedPlaceholder(entry) });
+    return true;
+}
+//# sourceMappingURL=content-blocks.js.map

package/dist/core/extensions/builtin/claude-sdk-oauth/content-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-blocks.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/content-blocks.ts"],"names":[],"mappings":"AAEA,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAU,CAAC;AAE1F,MAAM,UAAU,sBAAsB,CAAC,MAA2B,EAAE,OAAoC;IACvG,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC;IACjD,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACpD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACzC,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;QAC3C,IAAI,SAAS,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;IAC3C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;YACtF,OAAO,QAAQ;gBACd,CAAC,CAAC,gDAAgD,KAAK,CAAC,QAAQ,GAAG;gBACnE,CAAC,CAAC,qCAAqC,CAAC;QAC1C,CAAC;QACD,OAAO,uCAAuC,KAAK,CAAC,IAAI,GAAG,CAAC;IAC7D,CAAC;IACD,OAAO,qCAAqC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,KAA8B;IACrD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC3F,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO;QACN,IAAI,EAAE,OAAO;QACb,MAAM,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,KAAK,CAAC,IAAI;SAChB;KACD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAA2B,EAAE,KAAc;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC;AACb,CAAC","sourcesContent":["import type { Base64ImageSource, ContentBlockParam } from \"./sdk-boundary.ts\";\n\nconst IMAGE_MEDIA_TYPES = [\"image/jpeg\", \"image/png\", \"image/gif\", \"image/webp\"] as const;\n\nexport function appendSdkContentBlocks(blocks: ContentBlockParam[], content: string | readonly unknown[]): boolean {\n\tif (typeof content === \"string\") {\n\t\tif (content.length > 0) blocks.push({ type: \"text\", text: content });\n\t\treturn content.trim().length > 0;\n\t}\n\n\tlet hasText = false;\n\tfor (const entry of content) {\n\t\thasText = appendEntry(blocks, entry) || hasText;\n\t}\n\treturn hasText;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null;\n}\n\nfunction parseImageMediaType(value: string): Base64ImageSource[\"media_type\"] | undefined {\n\tfor (const mediaType of IMAGE_MEDIA_TYPES) {\n\t\tif (mediaType === value) return mediaType;\n\t}\n\treturn undefined;\n}\n\nfunction omittedPlaceholder(entry: unknown): string {\n\tif (isRecord(entry) && typeof entry.type === \"string\") {\n\t\tif (entry.type === \"image\") {\n\t\t\tconst complete = typeof entry.mimeType === \"string\" && typeof entry.data === \"string\";\n\t\t\treturn complete\n\t\t\t\t? `[image block omitted: unsupported media type ${entry.mimeType}]`\n\t\t\t\t: \"[image block omitted: missing data]\";\n\t\t}\n\t\treturn `[unsupported content block omitted: ${entry.type}]`;\n\t}\n\treturn \"[unsupported content block omitted]\";\n}\n\nfunction imageFromEntry(entry: Record<string, unknown>): ContentBlockParam | undefined {\n\tif (typeof entry.mimeType !== \"string\" || typeof entry.data !== \"string\") return undefined;\n\tconst mediaType = parseImageMediaType(entry.mimeType);\n\tif (mediaType === undefined) return undefined;\n\treturn {\n\t\ttype: \"image\",\n\t\tsource: {\n\t\t\ttype: \"base64\",\n\t\t\tmedia_type: mediaType,\n\t\t\tdata: entry.data,\n\t\t},\n\t};\n}\n\nfunction appendEntry(blocks: ContentBlockParam[], entry: unknown): boolean {\n\tif (typeof entry === \"string\") {\n\t\tblocks.push({ type: \"text\", text: entry });\n\t\treturn entry.trim().length > 0;\n\t}\n\n\tif (!isRecord(entry)) {\n\t\tblocks.push({ type: \"text\", text: omittedPlaceholder(entry) });\n\t\treturn true;\n\t}\n\n\tif (entry.type === \"text\") {\n\t\tif (typeof entry.text === \"string\") {\n\t\t\tblocks.push({ type: \"text\", text: entry.text });\n\t\t\treturn entry.text.trim().length > 0;\n\t\t}\n\t\tblocks.push({ type: \"text\", text: omittedPlaceholder(entry) });\n\t\treturn true;\n\t}\n\n\tif (entry.type === \"image\") {\n\t\tconst image = imageFromEntry(entry);\n\t\tif (image) {\n\t\t\tblocks.push(image);\n\t\t\treturn false;\n\t\t}\n\t\tblocks.push({ type: \"text\", text: omittedPlaceholder(entry) });\n\t\treturn true;\n\t}\n\n\tblocks.push({ type: \"text\", text: omittedPlaceholder(entry) });\n\treturn true;\n}\n"]}

package/dist/core/extensions/builtin/claude-sdk-oauth/errors.d.ts

@@ -1,8 +1,25 @@
-export type SdkErrorKind = "rate_limit" | "overloaded" | "auth_error" | "billing" | "org_not_allowed" | "other";
+import type { SDKMessage } from "./sdk-boundary.ts";
+export type SdkErrorKind = "rate_limit" | "overloaded" | "auth_error" | "billing" | "org_not_allowed" | "entitlement" | "other";
 export type SdkErrorClassification = {
     kind: SdkErrorKind;
     retryable: boolean;
 };
+export type SdkResultUsage = Extract<SDKMessage, {
+    type: "result";
+}>["usage"];
+/** A failed SDK result keeps the usage it billed so every lane can account for it. */
+export declare class SdkResultFailure extends Error {
+    readonly usage: SdkResultUsage | undefined;
+    constructor(message: string, usage: SdkResultUsage | undefined);
+}
+/** The usage carried by a failed SDK result, looking through failover's classification wrapper. */
+export declare function sdkResultFailureUsage(error: unknown): SdkResultUsage | undefined;
+export declare function sdkResultFailure(message: Extract<SDKMessage, {
+    type: "result";
+}>): SdkResultFailure | undefined;
+export declare function sdkAssistantFailure(message: Extract<SDKMessage, {
+    type: "assistant";
+}>): Error | undefined;
 /** Classifies Claude SDK OAuth error codes and HTTP-shaped fallback text in one place. */
 export declare function classifySdkError(error: unknown): SdkErrorClassification;
 //# sourceMappingURL=errors.d.ts.map

package/dist/core/extensions/builtin/claude-sdk-oauth/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/errors.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,iBAAiB,GAAG,OAAO,CAAC;AAEhH,MAAM,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACnB,CAAC;AAgCF,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAwBvE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/errors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,MAAM,YAAY,GACrB,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,SAAS,GACT,iBAAiB,GACjB,aAAa,GACb,OAAO,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACnB,CAAC;AAmCF,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CAAC,OAAO,CAAC,CAAC;AAE9E,sFAAsF;AACtF,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,CAAC;gBAE/B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,SAAS;CAK9D;AAED,mGAAmG;AACnG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAIhF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GAAG,gBAAgB,GAAG,SAAS,CAe/G;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,GAAG,KAAK,GAAG,SAAS,CAY1G;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,CAwCvE"}

package/dist/core/extensions/builtin/claude-sdk-oauth/errors.js

@@ -6,6 +6,9 @@ const SDK_ERROR_CLASSIFICATIONS = {
     overloaded: { kind: "overloaded", retryable: true },
     invalid_request: { kind: "other", retryable: false },
     server_error: { kind: "other", retryable: true },
+    account_on_hold: { kind: "billing", retryable: true },
+    model_not_found: { kind: "other", retryable: false },
+    max_output_tokens: { kind: "other", retryable: false },
 };
 const OTHER_ERROR = { kind: "other", retryable: false };
 function record(value) {
@@ -29,12 +32,56 @@ function errorText(error) {
         return code;
     return String(error);
 }
+/** A failed SDK result keeps the usage it billed so every lane can account for it. */
+export class SdkResultFailure extends Error {
+    constructor(message, usage) {
+        super(message);
+        this.name = "SdkResultFailure";
+        this.usage = usage;
+    }
+}
+/** The usage carried by a failed SDK result, looking through failover's classification wrapper. */
+export function sdkResultFailureUsage(error) {
+    if (error instanceof SdkResultFailure)
+        return error.usage;
+    const wrapped = record(error)?.original;
+    return wrapped instanceof SdkResultFailure ? wrapped.usage : undefined;
+}
+export function sdkResultFailure(message) {
+    if (message.subtype === "success" && message.is_error !== true)
+        return undefined;
+    const errors = "errors" in message && Array.isArray(message.errors) ? message.errors : [];
+    const firstError = errors.find((error) => typeof error === "string" && error.length > 0);
+    const resultText = "result" in message && typeof message.result === "string" ? message.result.trim() : "";
+    const detail = firstError ??
+        (message.is_error === true && resultText ? resultText : undefined) ??
+        `Claude Code ${message.subtype}`;
+    const status = "api_error_status" in message && message.api_error_status != null ? `HTTP ${message.api_error_status}` : "";
+    const reason = "terminal_reason" in message && typeof message.terminal_reason === "string" ? message.terminal_reason : "";
+    const suffix = [status, reason].filter(Boolean).join(", ");
+    return new SdkResultFailure(suffix ? `${detail} (${suffix})` : detail, message.usage);
+}
+export function sdkAssistantFailure(message) {
+    if (!message.error)
+        return undefined;
+    const content = message.message.content;
+    const text = (typeof content === "string"
+        ? content
+        : content
+            .filter((block) => block.type === "text" && "text" in block && typeof block.text === "string")
+            .map((block) => ("text" in block && typeof block.text === "string" ? block.text : ""))
+            .join(" ")).trim();
+    return new Error(text ? (message.error === "unknown" ? text : `${text} (${message.error})`) : message.error);
+}
 /** Classifies Claude SDK OAuth error codes and HTTP-shaped fallback text in one place. */
 export function classifySdkError(error) {
     const text = errorText(error).toLowerCase();
+    if (/\b(enotfound|eai_again|econnreset|econnrefused|etimedout|enetunreach|ehostunreach|und_err_connect_timeout|und_err_socket)\b|fetch failed|socket hang up|connection reset by peer/.test(text)) {
+        return { kind: "other", retryable: true };
+    }
     for (const [code, classification] of Object.entries(SDK_ERROR_CLASSIFICATIONS)) {
         if (new RegExp(`\\b${code}\\b`).test(text))
-            return classification;
+            return classification ?? OTHER_ERROR;
     }
     if (/\b(?:http\s*)?429\b|too many requests|rate[ _-]?limit/.test(text)) {
         return { kind: "rate_limit", retryable: true };
@@ -55,6 +102,15 @@ export function classifySdkError(error) {
     }
     if (/\b(?:http\s*)?529\b|overloaded/.test(text))
         return { kind: "overloaded", retryable: true };
+    if (/\binvalid_grant\b|\binvalid_token\b|\b(?:http\s*)?401\b|\bunauthorized\b/.test(text)) {
+        return { kind: "auth_error", retryable: true };
+    }
+    // Fable 5 and similar models are not in the subscription; Claude Code asks
+    // for usage credits. That is an account entitlement, not a 60s rate limit:
+    // blocking the only account would also block Opus fallback on it.
+    if (/\brequires usage credits\b|\/usage-credits\b|\bcredits_required\b/.test(text)) {
+        return { kind: "entitlement", retryable: false };
+    }
     return OTHER_ERROR;
 }
 //# sourceMappingURL=errors.js.map

package/dist/core/extensions/builtin/claude-sdk-oauth/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/errors.ts"],"names":[],"mappings":"AASA,MAAM,yBAAyB,GAAsE;IACpG,qBAAqB,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE;IAC9D,qBAAqB,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE;IACnE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;IACnD,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE;IACnD,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE;IACnD,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;IACpD,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE;CAChD,CAAC;AAEF,MAAM,WAAW,GAA2B,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAEhF,SAAS,MAAM,CAAC,KAAc;IAC7B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;IACzB,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAChF,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,cAAc,CAAC;IACnE,CAAC;IACD,IAAI,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,yEAAyE;IACzE,4CAA4C;IAC5C,0EAA0E;IAC1E,0DAA0D;IAC1D,4EAA4E;IAC5E,qDAAqD;IACrD,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,sFAAsF,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChG,OAAO,WAAW,CAAC;AACpB,CAAC","sourcesContent":["import type { SDKAssistantMessageError } from \"@anthropic-ai/claude-agent-sdk\";\n\nexport type SdkErrorKind = \"rate_limit\" | \"overloaded\" | \"auth_error\" | \"billing\" | \"org_not_allowed\" | \"other\";\n\nexport type SdkErrorClassification = {\n\tkind: SdkErrorKind;\n\tretryable: boolean;\n};\n\nconst SDK_ERROR_CLASSIFICATIONS: Partial<Record<SDKAssistantMessageError, SdkErrorClassification>> = {\n\tauthentication_failed: { kind: \"auth_error\", retryable: true },\n\toauth_org_not_allowed: { kind: \"org_not_allowed\", retryable: true },\n\tbilling_error: { kind: \"billing\", retryable: true },\n\trate_limit: { kind: \"rate_limit\", retryable: true },\n\toverloaded: { kind: \"overloaded\", retryable: true },\n\tinvalid_request: { kind: \"other\", retryable: false },\n\tserver_error: { kind: \"other\", retryable: true },\n};\n\nconst OTHER_ERROR: SdkErrorClassification = { kind: \"other\", retryable: false };\n\nfunction record(value: unknown): Record<string, unknown> | undefined {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value)\n\t\t? (value as Record<string, unknown>)\n\t\t: undefined;\n}\n\nfunction errorText(error: unknown): string {\n\tif (typeof error === \"string\") return error;\n\tif (error instanceof Error) return error.message;\n\tconst value = record(error);\n\tif (!value) return String(error);\n\tconst message = value.message;\n\tif (typeof message === \"string\") return message;\n\tconst code = value.error;\n\tif (typeof code === \"string\") return code;\n\treturn String(error);\n}\n\n/** Classifies Claude SDK OAuth error codes and HTTP-shaped fallback text in one place. */\nexport function classifySdkError(error: unknown): SdkErrorClassification {\n\tconst text = errorText(error).toLowerCase();\n\tfor (const [code, classification] of Object.entries(SDK_ERROR_CLASSIFICATIONS)) {\n\t\tif (new RegExp(`\\\\b${code}\\\\b`).test(text)) return classification;\n\t}\n\tif (/\\b(?:http\\s*)?429\\b|too many requests|rate[ _-]?limit/.test(text)) {\n\t\treturn { kind: \"rate_limit\", retryable: true };\n\t}\n\t// Claude Code signals subscription exhaustion two ways, neither of which\n\t// carries an SDK error code or HTTP status:\n\t//   - `terminal_reason: \"blocking_limit\"` / `\"rapid_refill_breaker\"` on a\n\t//     result message (surfaced by auth-lane's sdkFailure)\n\t//   - prose in `errors[0]`, e.g. \"You've hit your weekly limit · resets 5am\n\t//     (Asia/Seoul)\" and the 5-hour/daily equivalents\n\t// Without these branches both classify as non-retryable \"other\", so the\n\t// exhausted account is never blocked and a pool never rotates past it.\n\tif (/\\bblocking_limit\\b|\\brapid_refill_breaker\\b/.test(text)) {\n\t\treturn { kind: \"rate_limit\", retryable: true };\n\t}\n\tif (/\\b(?:hit|reached|exceeded)\\b[^.]*\\blimit\\b|\\b(?:weekly|daily|hourly|usage)\\s+limit\\b/.test(text)) {\n\t\treturn { kind: \"rate_limit\", retryable: true };\n\t}\n\tif (/\\b(?:http\\s*)?529\\b|overloaded/.test(text)) return { kind: \"overloaded\", retryable: true };\n\treturn OTHER_ERROR;\n}\n"]}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/errors.ts"],"names":[],"mappings":"AAiBA,MAAM,yBAAyB,GAAsE;IACpG,qBAAqB,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE;IAC9D,qBAAqB,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE;IACnE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;IACnD,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE;IACnD,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE;IACnD,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;IACpD,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE;IAChD,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;IACrD,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;IACpD,iBAAiB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE;CACtD,CAAC;AAEF,MAAM,WAAW,GAA2B,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAEhF,SAAS,MAAM,CAAC,KAAc;IAC7B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;IACzB,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAID,sFAAsF;AACtF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAG1C,YAAY,OAAe,EAAE,KAAiC;QAC7D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;CACD;AAED,mGAAmG;AACnG,MAAM,UAAU,qBAAqB,CAAC,KAAc;IACnD,IAAI,KAAK,YAAY,gBAAgB;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IACxC,OAAO,OAAO,YAAY,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgD;IAChF,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACjF,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1G,MAAM,UAAU,GAAG,QAAQ,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1G,MAAM,MAAM,GACX,UAAU;QACV,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,eAAe,OAAO,CAAC,OAAO,EAAE,CAAC;IAClC,MAAM,MAAM,GACX,kBAAkB,IAAI,OAAO,IAAI,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7G,MAAM,MAAM,GACX,iBAAiB,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5G,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAmD;IACtF,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC,MAAM,IAAI,GAAG,CACZ,OAAO,OAAO,KAAK,QAAQ;QAC1B,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,OAAO;aACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;aAC7F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACrF,IAAI,CAAC,GAAG,CAAC,CACb,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9G,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,IACC,kLAAkL,CAAC,IAAI,CACtL,IAAI,CACJ,EACA,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAChF,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,cAAc,IAAI,WAAW,CAAC;IAClF,CAAC;IACD,IAAI,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,yEAAyE;IACzE,4CAA4C;IAC5C,0EAA0E;IAC1E,0DAA0D;IAC1D,4EAA4E;IAC5E,qDAAqD;IACrD,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,sFAAsF,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChG,IAAI,0EAA0E,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3F,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC","sourcesContent":["import type { SDKAssistantMessageError } from \"@anthropic-ai/claude-agent-sdk\";\nimport type { SDKMessage } from \"./sdk-boundary.ts\";\n\nexport type SdkErrorKind =\n\t| \"rate_limit\"\n\t| \"overloaded\"\n\t| \"auth_error\"\n\t| \"billing\"\n\t| \"org_not_allowed\"\n\t| \"entitlement\"\n\t| \"other\";\n\nexport type SdkErrorClassification = {\n\tkind: SdkErrorKind;\n\tretryable: boolean;\n};\n\nconst SDK_ERROR_CLASSIFICATIONS: Partial<Record<SDKAssistantMessageError, SdkErrorClassification>> = {\n\tauthentication_failed: { kind: \"auth_error\", retryable: true },\n\toauth_org_not_allowed: { kind: \"org_not_allowed\", retryable: true },\n\tbilling_error: { kind: \"billing\", retryable: true },\n\trate_limit: { kind: \"rate_limit\", retryable: true },\n\toverloaded: { kind: \"overloaded\", retryable: true },\n\tinvalid_request: { kind: \"other\", retryable: false },\n\tserver_error: { kind: \"other\", retryable: true },\n\taccount_on_hold: { kind: \"billing\", retryable: true },\n\tmodel_not_found: { kind: \"other\", retryable: false },\n\tmax_output_tokens: { kind: \"other\", retryable: false },\n};\n\nconst OTHER_ERROR: SdkErrorClassification = { kind: \"other\", retryable: false };\n\nfunction record(value: unknown): Record<string, unknown> | undefined {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value)\n\t\t? (value as Record<string, unknown>)\n\t\t: undefined;\n}\n\nfunction errorText(error: unknown): string {\n\tif (typeof error === \"string\") return error;\n\tif (error instanceof Error) return error.message;\n\tconst value = record(error);\n\tif (!value) return String(error);\n\tconst message = value.message;\n\tif (typeof message === \"string\") return message;\n\tconst code = value.error;\n\tif (typeof code === \"string\") return code;\n\treturn String(error);\n}\n\nexport type SdkResultUsage = Extract<SDKMessage, { type: \"result\" }>[\"usage\"];\n\n/** A failed SDK result keeps the usage it billed so every lane can account for it. */\nexport class SdkResultFailure extends Error {\n\treadonly usage: SdkResultUsage | undefined;\n\n\tconstructor(message: string, usage: SdkResultUsage | undefined) {\n\t\tsuper(message);\n\t\tthis.name = \"SdkResultFailure\";\n\t\tthis.usage = usage;\n\t}\n}\n\n/** The usage carried by a failed SDK result, looking through failover's classification wrapper. */\nexport function sdkResultFailureUsage(error: unknown): SdkResultUsage | undefined {\n\tif (error instanceof SdkResultFailure) return error.usage;\n\tconst wrapped = record(error)?.original;\n\treturn wrapped instanceof SdkResultFailure ? wrapped.usage : undefined;\n}\n\nexport function sdkResultFailure(message: Extract<SDKMessage, { type: \"result\" }>): SdkResultFailure | undefined {\n\tif (message.subtype === \"success\" && message.is_error !== true) return undefined;\n\tconst errors = \"errors\" in message && Array.isArray(message.errors) ? message.errors : [];\n\tconst firstError = errors.find((error): error is string => typeof error === \"string\" && error.length > 0);\n\tconst resultText = \"result\" in message && typeof message.result === \"string\" ? message.result.trim() : \"\";\n\tconst detail =\n\t\tfirstError ??\n\t\t(message.is_error === true && resultText ? resultText : undefined) ??\n\t\t`Claude Code ${message.subtype}`;\n\tconst status =\n\t\t\"api_error_status\" in message && message.api_error_status != null ? `HTTP ${message.api_error_status}` : \"\";\n\tconst reason =\n\t\t\"terminal_reason\" in message && typeof message.terminal_reason === \"string\" ? message.terminal_reason : \"\";\n\tconst suffix = [status, reason].filter(Boolean).join(\", \");\n\treturn new SdkResultFailure(suffix ? `${detail} (${suffix})` : detail, message.usage);\n}\n\nexport function sdkAssistantFailure(message: Extract<SDKMessage, { type: \"assistant\" }>): Error | undefined {\n\tif (!message.error) return undefined;\n\tconst content = message.message.content;\n\tconst text = (\n\t\ttypeof content === \"string\"\n\t\t\t? content\n\t\t\t: content\n\t\t\t\t\t.filter((block) => block.type === \"text\" && \"text\" in block && typeof block.text === \"string\")\n\t\t\t\t\t.map((block) => (\"text\" in block && typeof block.text === \"string\" ? block.text : \"\"))\n\t\t\t\t\t.join(\" \")\n\t).trim();\n\treturn new Error(text ? (message.error === \"unknown\" ? text : `${text} (${message.error})`) : message.error);\n}\n\n/** Classifies Claude SDK OAuth error codes and HTTP-shaped fallback text in one place. */\nexport function classifySdkError(error: unknown): SdkErrorClassification {\n\tconst text = errorText(error).toLowerCase();\n\tif (\n\t\t/\\b(enotfound|eai_again|econnreset|econnrefused|etimedout|enetunreach|ehostunreach|und_err_connect_timeout|und_err_socket)\\b|fetch failed|socket hang up|connection reset by peer/.test(\n\t\t\ttext,\n\t\t)\n\t) {\n\t\treturn { kind: \"other\", retryable: true };\n\t}\n\tfor (const [code, classification] of Object.entries(SDK_ERROR_CLASSIFICATIONS)) {\n\t\tif (new RegExp(`\\\\b${code}\\\\b`).test(text)) return classification ?? OTHER_ERROR;\n\t}\n\tif (/\\b(?:http\\s*)?429\\b|too many requests|rate[ _-]?limit/.test(text)) {\n\t\treturn { kind: \"rate_limit\", retryable: true };\n\t}\n\t// Claude Code signals subscription exhaustion two ways, neither of which\n\t// carries an SDK error code or HTTP status:\n\t//   - `terminal_reason: \"blocking_limit\"` / `\"rapid_refill_breaker\"` on a\n\t//     result message (surfaced by auth-lane's sdkFailure)\n\t//   - prose in `errors[0]`, e.g. \"You've hit your weekly limit · resets 5am\n\t//     (Asia/Seoul)\" and the 5-hour/daily equivalents\n\t// Without these branches both classify as non-retryable \"other\", so the\n\t// exhausted account is never blocked and a pool never rotates past it.\n\tif (/\\bblocking_limit\\b|\\brapid_refill_breaker\\b/.test(text)) {\n\t\treturn { kind: \"rate_limit\", retryable: true };\n\t}\n\tif (/\\b(?:hit|reached|exceeded)\\b[^.]*\\blimit\\b|\\b(?:weekly|daily|hourly|usage)\\s+limit\\b/.test(text)) {\n\t\treturn { kind: \"rate_limit\", retryable: true };\n\t}\n\tif (/\\b(?:http\\s*)?529\\b|overloaded/.test(text)) return { kind: \"overloaded\", retryable: true };\n\tif (/\\binvalid_grant\\b|\\binvalid_token\\b|\\b(?:http\\s*)?401\\b|\\bunauthorized\\b/.test(text)) {\n\t\treturn { kind: \"auth_error\", retryable: true };\n\t}\n\t// Fable 5 and similar models are not in the subscription; Claude Code asks\n\t// for usage credits. That is an account entitlement, not a 60s rate limit:\n\t// blocking the only account would also block Opus fallback on it.\n\tif (/\\brequires usage credits\\b|\\/usage-credits\\b|\\bcredits_required\\b/.test(text)) {\n\t\treturn { kind: \"entitlement\", retryable: false };\n\t}\n\treturn OTHER_ERROR;\n}\n"]}

package/dist/core/extensions/builtin/claude-sdk-oauth/guidance.d.ts

@@ -1,6 +1,7 @@
 import type { SdkErrorKind } from "./errors.ts";
 export declare function noAccountGuidance(hasAnthropicCredential: boolean): string;
 export declare function allAccountsBlockedGuidance(soonestUnblockAt: number | undefined): string;
+export declare function claudeCodeVersionFloorGuidance(text: string): string | undefined;
 export declare function sdkErrorGuidance(kind: SdkErrorKind): string | undefined;
 export declare function missingBinaryGuidance(platform: string, arch: string): string;
 export type SystemPromptMode = "full" | "override" | "preset-append";

package/dist/core/extensions/builtin/claude-sdk-oauth/guidance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guidance.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/guidance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIhD,wBAAgB,iBAAiB,CAAC,sBAAsB,EAAE,OAAO,GAAG,MAAM,CAazE;AAED,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAWvF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAWvE;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAK5E;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,UAAU,GAAG,eAAe,CAAC;AAErE,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM7F;AAID,wBAAgB,4BAA4B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAMrE;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,GAAG,SAAS,CAqBrB"}
+{"version":3,"file":"guidance.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/guidance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIhD,wBAAgB,iBAAiB,CAAC,sBAAsB,EAAE,OAAO,GAAG,MAAM,CAazE;AAED,wBAAgB,0BAA0B,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAWvF;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAa/E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAavE;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAK5E;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,UAAU,GAAG,eAAe,CAAC;AAErE,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM7F;AAID,wBAAgB,4BAA4B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAMrE;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,GAAG,SAAS,CAqBrB"}

package/dist/core/extensions/builtin/claude-sdk-oauth/guidance.js

@@ -21,6 +21,17 @@ export function allAccountsBlockedGuidance(soonestUnblockAt) {
         `  /login ${PROVIDER}  - add another account`,
     ].join("\n");
 }
+export function claudeCodeVersionFloorGuidance(text) {
+    const floor = /does not support this model; version (\S+?) or newer is required|claude_code_version_too_old/i.exec(text);
+    if (floor) {
+        const target = floor[1] === undefined ? "a newer Claude Code" : `Claude Code ${floor[1].replace(/[.,;:]+$/, "")} or newer`;
+        return `The bundled Claude Code binary is too old for this model. Update senpi/omo (it ships a newer @anthropic-ai/claude-agent-sdk) or set CLAUDE_CODE_EXECUTABLE to ${target} binary.`;
+    }
+    if (/\bmodel_not_found\b|unrecognized_model|not found for provider/i.test(text)) {
+        return "The bundled Claude Code binary does not know this model id; update senpi/omo or set CLAUDE_CODE_EXECUTABLE to a newer Claude Code binary.";
+    }
+    return undefined;
+}
 export function sdkErrorGuidance(kind) {
     switch (kind) {
         case "org_not_allowed":
@@ -29,6 +40,8 @@ export function sdkErrorGuidance(kind) {
             return "The selected Claude account has a billing problem. Check the plan at claude.com or switch accounts with /claude-account pin <name>.";
         case "auth_error":
             return `The account's OAuth token was rejected. Re-run /login ${PROVIDER} to refresh it, or remove the account with /claude-account remove <name>.`;
+        case "entitlement":
+            return "This model needs usage credits on the selected Claude account (it is not included in the subscription). Switch models with /model, enable usage credits at claude.com, or pick another account with /claude-account pin <name>.";
         default:
             return undefined;
     }

package/dist/core/extensions/builtin/claude-sdk-oauth/guidance.js.map

@@ -1 +1 @@
-{"version":3,"file":"guidance.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/guidance.ts"],"names":[],"mappings":"AAEA,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAEpC,MAAM,UAAU,iBAAiB,CAAC,sBAA+B;IAChE,MAAM,KAAK,GAAG;QACb,oCAAoC,QAAQ,GAAG;QAC/C,YAAY,QAAQ,mDAAmD;KACvE,CAAC;IACF,IAAI,sBAAsB,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,CAAC,IAAI,CACT,kEAAkE,EAClE,mDAAmD,CACnD,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,gBAAoC;IAC9E,MAAM,GAAG,GACR,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClE,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE;QAC1C,CAAC,CAAC,gBAAgB,CAAC;IACrB,OAAO;QACN,2BAA2B,QAAQ,qDAAqD;QACxF,8BAA8B,GAAG,GAAG;QACpC,kDAAkD;QAClD,YAAY,QAAQ,yBAAyB;KAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAkB;IAClD,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,iBAAiB;YACrB,OAAO,kJAAkJ,CAAC;QAC3J,KAAK,SAAS;YACb,OAAO,qIAAqI,CAAC;QAC9I,KAAK,YAAY;YAChB,OAAO,yDAAyD,QAAQ,2EAA2E,CAAC;QACrJ;YACC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,IAAY;IACnE,OAAO;QACN,sCAAsC,QAAQ,IAAI,IAAI,GAAG;QACzD,kGAAkG;KAClG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAID,MAAM,UAAU,4BAA4B,CAAC,IAAwB,EAAE,MAAc;IACpF,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,IAAI,GAAG,CAAC;IACtF,OAAO;QACN,mDAAmD,MAAM,KAAK,MAAM,GAAG;QACvE,4HAA4H;KAC5H,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AAExC,MAAM,UAAU,4BAA4B,CAAC,SAAkB;IAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACP,aAAa,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAI/C;IACA,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAY,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CACT,kDAAkD;YACjD,yDAAyD;YACzD,kDAAkD,CACnD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC","sourcesContent":["import type { SdkErrorKind } from \"./errors.ts\";\n\nconst PROVIDER = \"claude-sdk-oauth\";\n\nexport function noAccountGuidance(hasAnthropicCredential: boolean): string {\n\tconst lines = [\n\t\t`No Claude account configured for ${PROVIDER}.`,\n\t\t`  /login ${PROVIDER}  - sign in with your Claude Pro/Max subscription`,\n\t];\n\tif (hasAnthropicCredential) {\n\t\tlines.push(\"  (your existing Anthropic OAuth login will be offered as an import)\");\n\t}\n\tlines.push(\n\t\t\"  Or set CLAUDE_CODE_OAUTH_TOKEN (and _2.._N for more accounts),\",\n\t\t\"  or log in with the claude CLI for ambient auth.\",\n\t);\n\treturn lines.join(\"\\n\");\n}\n\nexport function allAccountsBlockedGuidance(soonestUnblockAt: number | undefined): string {\n\tconst eta =\n\t\tsoonestUnblockAt !== undefined && Number.isFinite(soonestUnblockAt)\n\t\t\t? new Date(soonestUnblockAt).toISOString()\n\t\t\t: \"after re-login\";\n\treturn [\n\t\t`All Claude accounts for ${PROVIDER} are currently blocked (rate limit or auth errors).`,\n\t\t`  Soonest automatic retry: ${eta}.`,\n\t\t`  /claude-account list  - inspect account states`,\n\t\t`  /login ${PROVIDER}  - add another account`,\n\t].join(\"\\n\");\n}\n\nexport function sdkErrorGuidance(kind: SdkErrorKind): string | undefined {\n\tswitch (kind) {\n\t\tcase \"org_not_allowed\":\n\t\t\treturn \"This organization's policy disallows subscription OAuth use here. Use an API key (ANTHROPIC_API_KEY) or an account from an allowed organization.\";\n\t\tcase \"billing\":\n\t\t\treturn \"The selected Claude account has a billing problem. Check the plan at claude.com or switch accounts with /claude-account pin <name>.\";\n\t\tcase \"auth_error\":\n\t\t\treturn `The account's OAuth token was rejected. Re-run /login ${PROVIDER} to refresh it, or remove the account with /claude-account remove <name>.`;\n\t\tdefault:\n\t\t\treturn undefined;\n\t}\n}\n\nexport function missingBinaryGuidance(platform: string, arch: string): string {\n\treturn [\n\t\t`Claude native binary not found for ${platform}-${arch}.`,\n\t\t\"Reinstall @anthropic-ai/claude-agent-sdk without --omit=optional, or set CLAUDE_CODE_EXECUTABLE.\",\n\t].join(\"\\n\");\n}\n\nexport type SystemPromptMode = \"full\" | \"override\" | \"preset-append\";\n\nexport function overrideSystemPromptGuidance(path: string | undefined, reason: string): string {\n\tconst target = path === undefined ? \"systemPromptFile\" : `systemPromptFile \"${path}\"`;\n\treturn [\n\t\t`Claude SDK OAuth override prompt could not load ${target}: ${reason}.`,\n\t\t'Set claudeSdkOauthProvider.systemPromptFile to a readable, non-empty UTF-8 prompt file, or select systemPromptMode \"full\".',\n\t].join(\" \");\n}\n\nconst armedSessions = new Set<string>();\n\nexport function resetPresetAppendDeprecation(sessionId?: string): void {\n\tif (sessionId !== undefined) {\n\t\tarmedSessions.delete(sessionId);\n\t} else {\n\t\tarmedSessions.clear();\n\t}\n}\n\nexport function presetAppendDeprecationGuidance(options: {\n\tmode: SystemPromptMode;\n\tconflict?: boolean;\n\tsessionId: string;\n}): string | undefined {\n\tif (armedSessions.has(options.sessionId)) {\n\t\treturn undefined;\n\t}\n\tconst isDeprecated = options.mode === \"preset-append\";\n\tif (!options.conflict && !isDeprecated) {\n\t\treturn undefined;\n\t}\n\tarmedSessions.add(options.sessionId);\n\tconst parts: string[] = [];\n\tif (isDeprecated) {\n\t\tparts.push(\n\t\t\t\"preset-append system-prompt mode is deprecated; \" +\n\t\t\t\t\"`full` mode delivers the complete senpi system prompt; \" +\n\t\t\t\t\"preset-append will be removed after one release.\",\n\t\t);\n\t}\n\tif (options.conflict) {\n\t\tparts.push(\"systemPromptMode wins.\");\n\t}\n\treturn parts.join(\" \");\n}\n"]}
+{"version":3,"file":"guidance.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/guidance.ts"],"names":[],"mappings":"AAEA,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAEpC,MAAM,UAAU,iBAAiB,CAAC,sBAA+B;IAChE,MAAM,KAAK,GAAG;QACb,oCAAoC,QAAQ,GAAG;QAC/C,YAAY,QAAQ,mDAAmD;KACvE,CAAC;IACF,IAAI,sBAAsB,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,CAAC,IAAI,CACT,kEAAkE,EAClE,mDAAmD,CACnD,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,gBAAoC;IAC9E,MAAM,GAAG,GACR,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClE,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE;QAC1C,CAAC,CAAC,gBAAgB,CAAC;IACrB,OAAO;QACN,2BAA2B,QAAQ,qDAAqD;QACxF,8BAA8B,GAAG,GAAG;QACpC,kDAAkD;QAClD,YAAY,QAAQ,yBAAyB;KAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,IAAY;IAC1D,MAAM,KAAK,GAAG,+FAA+F,CAAC,IAAI,CACjH,IAAI,CACJ,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,MAAM,GACX,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,WAAW,CAAC;QAC7G,OAAO,iKAAiK,MAAM,UAAU,CAAC;IAC1L,CAAC;IACD,IAAI,gEAAgE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,OAAO,2IAA2I,CAAC;IACpJ,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAkB;IAClD,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,iBAAiB;YACrB,OAAO,kJAAkJ,CAAC;QAC3J,KAAK,SAAS;YACb,OAAO,qIAAqI,CAAC;QAC9I,KAAK,YAAY;YAChB,OAAO,yDAAyD,QAAQ,2EAA2E,CAAC;QACrJ,KAAK,aAAa;YACjB,OAAO,iOAAiO,CAAC;QAC1O;YACC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,IAAY;IACnE,OAAO;QACN,sCAAsC,QAAQ,IAAI,IAAI,GAAG;QACzD,kGAAkG;KAClG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAID,MAAM,UAAU,4BAA4B,CAAC,IAAwB,EAAE,MAAc;IACpF,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,IAAI,GAAG,CAAC;IACtF,OAAO;QACN,mDAAmD,MAAM,KAAK,MAAM,GAAG;QACvE,4HAA4H;KAC5H,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AAExC,MAAM,UAAU,4BAA4B,CAAC,SAAkB;IAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACP,aAAa,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAI/C;IACA,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAY,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CACT,kDAAkD;YACjD,yDAAyD;YACzD,kDAAkD,CACnD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC","sourcesContent":["import type { SdkErrorKind } from \"./errors.ts\";\n\nconst PROVIDER = \"claude-sdk-oauth\";\n\nexport function noAccountGuidance(hasAnthropicCredential: boolean): string {\n\tconst lines = [\n\t\t`No Claude account configured for ${PROVIDER}.`,\n\t\t`  /login ${PROVIDER}  - sign in with your Claude Pro/Max subscription`,\n\t];\n\tif (hasAnthropicCredential) {\n\t\tlines.push(\"  (your existing Anthropic OAuth login will be offered as an import)\");\n\t}\n\tlines.push(\n\t\t\"  Or set CLAUDE_CODE_OAUTH_TOKEN (and _2.._N for more accounts),\",\n\t\t\"  or log in with the claude CLI for ambient auth.\",\n\t);\n\treturn lines.join(\"\\n\");\n}\n\nexport function allAccountsBlockedGuidance(soonestUnblockAt: number | undefined): string {\n\tconst eta =\n\t\tsoonestUnblockAt !== undefined && Number.isFinite(soonestUnblockAt)\n\t\t\t? new Date(soonestUnblockAt).toISOString()\n\t\t\t: \"after re-login\";\n\treturn [\n\t\t`All Claude accounts for ${PROVIDER} are currently blocked (rate limit or auth errors).`,\n\t\t`  Soonest automatic retry: ${eta}.`,\n\t\t`  /claude-account list  - inspect account states`,\n\t\t`  /login ${PROVIDER}  - add another account`,\n\t].join(\"\\n\");\n}\n\nexport function claudeCodeVersionFloorGuidance(text: string): string | undefined {\n\tconst floor = /does not support this model; version (\\S+?) or newer is required|claude_code_version_too_old/i.exec(\n\t\ttext,\n\t);\n\tif (floor) {\n\t\tconst target =\n\t\t\tfloor[1] === undefined ? \"a newer Claude Code\" : `Claude Code ${floor[1].replace(/[.,;:]+$/, \"\")} or newer`;\n\t\treturn `The bundled Claude Code binary is too old for this model. Update senpi/omo (it ships a newer @anthropic-ai/claude-agent-sdk) or set CLAUDE_CODE_EXECUTABLE to ${target} binary.`;\n\t}\n\tif (/\\bmodel_not_found\\b|unrecognized_model|not found for provider/i.test(text)) {\n\t\treturn \"The bundled Claude Code binary does not know this model id; update senpi/omo or set CLAUDE_CODE_EXECUTABLE to a newer Claude Code binary.\";\n\t}\n\treturn undefined;\n}\n\nexport function sdkErrorGuidance(kind: SdkErrorKind): string | undefined {\n\tswitch (kind) {\n\t\tcase \"org_not_allowed\":\n\t\t\treturn \"This organization's policy disallows subscription OAuth use here. Use an API key (ANTHROPIC_API_KEY) or an account from an allowed organization.\";\n\t\tcase \"billing\":\n\t\t\treturn \"The selected Claude account has a billing problem. Check the plan at claude.com or switch accounts with /claude-account pin <name>.\";\n\t\tcase \"auth_error\":\n\t\t\treturn `The account's OAuth token was rejected. Re-run /login ${PROVIDER} to refresh it, or remove the account with /claude-account remove <name>.`;\n\t\tcase \"entitlement\":\n\t\t\treturn \"This model needs usage credits on the selected Claude account (it is not included in the subscription). Switch models with /model, enable usage credits at claude.com, or pick another account with /claude-account pin <name>.\";\n\t\tdefault:\n\t\t\treturn undefined;\n\t}\n}\n\nexport function missingBinaryGuidance(platform: string, arch: string): string {\n\treturn [\n\t\t`Claude native binary not found for ${platform}-${arch}.`,\n\t\t\"Reinstall @anthropic-ai/claude-agent-sdk without --omit=optional, or set CLAUDE_CODE_EXECUTABLE.\",\n\t].join(\"\\n\");\n}\n\nexport type SystemPromptMode = \"full\" | \"override\" | \"preset-append\";\n\nexport function overrideSystemPromptGuidance(path: string | undefined, reason: string): string {\n\tconst target = path === undefined ? \"systemPromptFile\" : `systemPromptFile \"${path}\"`;\n\treturn [\n\t\t`Claude SDK OAuth override prompt could not load ${target}: ${reason}.`,\n\t\t'Set claudeSdkOauthProvider.systemPromptFile to a readable, non-empty UTF-8 prompt file, or select systemPromptMode \"full\".',\n\t].join(\" \");\n}\n\nconst armedSessions = new Set<string>();\n\nexport function resetPresetAppendDeprecation(sessionId?: string): void {\n\tif (sessionId !== undefined) {\n\t\tarmedSessions.delete(sessionId);\n\t} else {\n\t\tarmedSessions.clear();\n\t}\n}\n\nexport function presetAppendDeprecationGuidance(options: {\n\tmode: SystemPromptMode;\n\tconflict?: boolean;\n\tsessionId: string;\n}): string | undefined {\n\tif (armedSessions.has(options.sessionId)) {\n\t\treturn undefined;\n\t}\n\tconst isDeprecated = options.mode === \"preset-append\";\n\tif (!options.conflict && !isDeprecated) {\n\t\treturn undefined;\n\t}\n\tarmedSessions.add(options.sessionId);\n\tconst parts: string[] = [];\n\tif (isDeprecated) {\n\t\tparts.push(\n\t\t\t\"preset-append system-prompt mode is deprecated; \" +\n\t\t\t\t\"`full` mode delivers the complete senpi system prompt; \" +\n\t\t\t\t\"preset-append will be removed after one release.\",\n\t\t);\n\t}\n\tif (options.conflict) {\n\t\tparts.push(\"systemPromptMode wins.\");\n\t}\n\treturn parts.join(\" \");\n}\n"]}

package/dist/core/extensions/builtin/claude-sdk-oauth/oauth-login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-login.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/oauth-login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,SAAS,EACT,WAAW,EACX,UAAU,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAEhB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAGN,KAAK,wBAAwB,EAI7B,MAAM,eAAe,CAAC;AAGvB,MAAM,MAAM,mBAAmB,GAAG;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClF,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;AAE1F,MAAM,MAAM,gBAAgB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,KAAK,EAAE;QACZ,GAAG,EAAE,WAAW,CAAC;QACjB,UAAU,CAAC,EAAE,eAAe,CAAC;QAC7B,MAAM,CAAC,EAAE,WAAW,CAAC;KACrB,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE;QACrB,GAAG,EAAE,WAAW,CAAC;QACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,EAAE,WAAW,CAAC;KACrB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACpC,KAAK,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjE,YAAY,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvE,SAAS,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,CAAC;CACjD,CAAC;AAEF,eAAO,MAAM,qBAAqB,sCAAsC,CAAC;AAqCzE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACvC,WAAW,EAAE,uBAAuB,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IAC1G,qBAAqB,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,YAAY,CAAC,EAAE,MAAM;QAAE,cAAc,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,SAAS,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IAClH,SAAS,CAAC,EAAE,SAAS,CAAC;CACtB,GAAG,gBAAgB,CAsGnB"}
+{"version":3,"file":"oauth-login.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/oauth-login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,SAAS,EACT,WAAW,EACX,UAAU,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAEhB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAGN,KAAK,wBAAwB,EAI7B,MAAM,eAAe,CAAC;AAGvB,MAAM,MAAM,mBAAmB,GAAG;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClF,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;AAE1F,MAAM,MAAM,gBAAgB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,KAAK,EAAE;QACZ,GAAG,EAAE,WAAW,CAAC;QACjB,UAAU,CAAC,EAAE,eAAe,CAAC;QAC7B,MAAM,CAAC,EAAE,WAAW,CAAC;KACrB,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE;QACrB,GAAG,EAAE,WAAW,CAAC;QACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,EAAE,WAAW,CAAC;KACrB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACpC,KAAK,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjE,YAAY,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvE,SAAS,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,CAAC;CACjD,CAAC;AAEF,eAAO,MAAM,qBAAqB,sCAAsC,CAAC;AAqCzE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACvC,WAAW,EAAE,uBAAuB,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IAC1G,qBAAqB,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,YAAY,CAAC,EAAE,MAAM;QAAE,cAAc,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,SAAS,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IAClH,SAAS,CAAC,EAAE,SAAS,CAAC;CACtB,GAAG,gBAAgB,CA4GnB"}

package/dist/core/extensions/builtin/claude-sdk-oauth/oauth-login.js

@@ -40,9 +40,14 @@ export function createOAuthConfig(deps) {
     /** Single predicate behind both `check` and `resolveAmbient`, so availability and resolution cannot disagree. */
     const configuredFor = async (ctx, stored, signal, environment) => {
         const storedAccounts = stored?.type === "oauth" && Array.isArray(stored.accounts) ? stored.accounts : [];
+        // Slot-scoped resolution projects one account onto the flat credential shape,
+        // stripping `accounts`; its concrete (non-sentinel) tokens are that account.
+        const selectedStoredAccount = stored?.type === "oauth" &&
+            stored.access !== SENTINEL_OAUTH_FIELDS.access &&
+            stored.refresh !== SENTINEL_OAUTH_FIELDS.refresh;
         const effectiveEnvironment = environment ?? (await claudeEnvironment(ctx));
         const environmentTokenCount = Object.values(effectiveEnvironment).filter(Boolean).length;
-        const accountCount = storedAccounts.length + environmentTokenCount;
+        const accountCount = storedAccounts.length + (selectedStoredAccount ? 1 : 0) + environmentTokenCount;
         const settings = deps.readSettings?.();
         const lane = settings?.tokenInjection ?? (accountCount > 0 ? "oauth-slots" : "ambient");
         if (lane === "ambient") {

package/dist/core/extensions/builtin/claude-sdk-oauth/oauth-login.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-login.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/oauth-login.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAEN,UAAU,EAEV,eAAe,EACf,YAAY,EACZ,qBAAqB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAoChE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AACzE,MAAM,eAAe,GAAG;IACvB,yBAAyB;IACzB,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,2BAA2B,KAAK,GAAG,CAAC,EAAE,CAAC;CAC1E,CAAC;AACX,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,eAAe,CAAC,CAAC;AAC5D,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,EAAW,CAAC;AAE1E,SAAS,wBAAwB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnF,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC1F,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,SAAS,MAAM,CACd,UAAgE,EAChE,IAAY,EACZ,MAA6B;IAE7B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;AAC9G,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,SAA8B,EAAE,QAAuB;IACvF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC,SAAS,CAAC,QAAQ;QAAE,OAAO,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,CACd,MAAM,SAAS,CAAC,QAAQ,CAAC;QACxB,OAAO,EAAE,oCAAoC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC5F,WAAW,EAAE,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;KAC7C,CAAC,CACF,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,MAAM,IAAI,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAMjC;IACA,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAgB,EAAmC,EAAE;QACrF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAU,CAAC,CAAC,CAAC;QAC7G,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAsC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;IAClH,CAAC,CAAC;IAEF,iHAAiH;IACjH,MAAM,aAAa,GAAG,KAAK,EAC1B,GAAgB,EAChB,MAA4C,EAC5C,MAAoB,EACpB,WAAoC,EACjB,EAAE;QACrB,MAAM,cAAc,GAAG,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,oBAAoB,GAAG,WAAW,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACzF,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,GAAG,qBAAqB,CAAC;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,EAAE,cAAc,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,qBAAqB,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3C,sEAAsE;YACtE,iEAAiE;YACjE,2DAA2D;YAC3D,IAAI,QAAQ,EAAE,OAAO,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,qBAAqB,IAAI,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,YAAY,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO;QACN,IAAI,EAAE,qBAAqB;QAE3B,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE;YACtC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACrE,OAAO,CAAC,MAAM,aAAa,CAC1B,GAAG,EACH,UAAkD,EAClD,MAAM,EACN,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;gBACD,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,SAAS,CAAC;QACd,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE;YACxC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;YACzD,MAAM,WAAW,GAChB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAChG,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YAClF,OAAO;gBACN,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE;gBAC9C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,MAAM,EAAE,UAAU,CAAC,MAAM;aACzB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAS;YACpB,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,eAAe,EAAE,CAAC;YAChE,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,uBAAuB,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACtD,IAAI,QAAQ,EAAE,CAAC;oBACd,MAAM,MAAM,GAAG,CACd,MAAM,SAAS,CAAC,QAAQ,CAAC;wBACxB,OAAO,EAAE,kFAAkF;qBAC3F,CAAC,CACF;yBACC,IAAI,EAAE;yBACN,WAAW,EAAE,CAAC;oBAChB,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACxC,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;oBAC9E,CAAC;gBACF,CAAC;YACF,CAAC;YACD,MAAM,WAAW,GAA4B;gBAC5C,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM;gBACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACxB,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;wBAAE,OAAO,EAAE,CAAC;oBACxC,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,CAAC;gBACD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBACjB,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,MAAM;wBAAE,KAAK,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;oBAC7F,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,UAAU;wBAAE,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5F,CAAC;aACD,CAAC;YACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAEjD,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAC/D,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,WAAW;YAC7B,OAAO,WAAW,CAAC;QACpB,CAAC;QAED,SAAS,CAAC,YAAY;YACrB,OAAO,qBAAqB,CAAC,MAAM,CAAC;QACrC,CAAC;KACD,CAAC;AACH,CAAC","sourcesContent":["import type {\n\tAuthCheck,\n\tAuthContext,\n\tAuthResult,\n\tOAuthAuth,\n\tOAuthCredential,\n\tOAuthCredentials,\n\tProviderAuthInteraction,\n} from \"@earendil-works/pi-ai\";\nimport { loadAnthropicOAuth } from \"@earendil-works/pi-ai/oauth\";\nimport {\n\ttype AccountSlot,\n\taddAccount,\n\ttype ClaudeSdkOauthCredential,\n\temptyCredential,\n\tlistAccounts,\n\tSENTINEL_OAUTH_FIELDS,\n} from \"./accounts.ts\";\nimport { readAmbientClaudeAuthStatus } from \"./availability.ts\";\n\nexport type OAuthLoginCallbacks = {\n\tsignal?: AbortSignal;\n\tonAuth?: (event: { url: string }) => void | Promise<void>;\n\tonPrompt?: (prompt: { message: string; placeholder?: string }) => Promise<string>;\n\tonManualCodeInput?: () => Promise<string>;\n\tonProgress?: (message: string) => void;\n};\n\nexport type CurrentCredentialReader = () => Promise<ClaudeSdkOauthCredential | undefined>;\n\nexport type OAuthConfigShape = {\n\tname: string;\n\tcheck(input: {\n\t\tctx: AuthContext;\n\t\tcredential?: OAuthCredential;\n\t\tsignal?: AbortSignal;\n\t}): Promise<AuthCheck | undefined>;\n\t/**\n\t * Request auth for the ambient lane — an environment OAuth token or a\n\t * logged-in Claude CLI — used when auth.json holds no managed accounts.\n\t * The SDK subprocess authenticates itself in that lane, so the sentinel is\n\t * the whole credential; without this the provider passes `check` and then\n\t * fails every request with \"Provider is not configured\".\n\t */\n\tresolveAmbient(input: {\n\t\tctx: AuthContext;\n\t\tenv?: Record<string, string>;\n\t\tsignal?: AbortSignal;\n\t}): Promise<AuthResult | undefined>;\n\tlogin(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;\n\trefreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;\n\tgetApiKey(credentials: OAuthCredentials): string;\n};\n\nexport const CLAUDE_SDK_OAUTH_NAME = \"Claude SDK OAuth (Claude Pro/Max)\";\nconst ENV_TOKEN_NAMES = [\n\t\"CLAUDE_CODE_OAUTH_TOKEN\",\n\t...Array.from({ length: 15 }, (_, index) => `CLAUDE_CODE_OAUTH_TOKEN_${index + 2}`),\n] as const;\nconst ENV_TOKEN_NAME_SET = new Set<string>(ENV_TOKEN_NAMES);\nconst AUTH_CHECK = { source: \"Claude SDK OAuth\", type: \"oauth\" } as const;\n\nfunction requestClaudeEnvironment(value: unknown): Record<string, string> {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) return {};\n\tconst environment: Record<string, string> = {};\n\tfor (const [name, entry] of Object.entries(value)) {\n\t\tif (ENV_TOKEN_NAME_SET.has(name) && typeof entry === \"string\") environment[name] = entry;\n\t}\n\treturn environment;\n}\n\nfunction toSlot(\n\tcredential: { access: string; refresh: string; expires: number },\n\tname: string,\n\tsource: AccountSlot[\"source\"],\n): AccountSlot {\n\treturn { name, access: credential.access, refresh: credential.refresh, expires: credential.expires, source };\n}\n\nasync function promptAccountName(callbacks: OAuthLoginCallbacks, existing: AccountSlot[]): Promise<string> {\n\tif (existing.length === 0) return \"default\";\n\tif (!callbacks.onPrompt) return `account-${existing.length + 1}`;\n\tconst answer = (\n\t\tawait callbacks.onPrompt({\n\t\t\tmessage: `Name for this account (existing: ${existing.map((slot) => slot.name).join(\", \")})`,\n\t\t\tplaceholder: `account-${existing.length + 1}`,\n\t\t})\n\t).trim();\n\treturn answer || `account-${existing.length + 1}`;\n}\n\nexport function createOAuthConfig(deps: {\n\treadCurrent: CurrentCredentialReader;\n\treadAnthropicCredential?: () => Promise<{ access: string; refresh: string; expires: number } | undefined>;\n\treadAmbientAuthStatus?: (signal?: AbortSignal) => Promise<boolean>;\n\treadSettings?: () => { tokenInjection?: \"oauth-slots\" | \"config-dir\" | \"ambient\"; enabled?: boolean } | undefined;\n\tloginFlow?: OAuthAuth;\n}): OAuthConfigShape {\n\tconst claudeEnvironment = async (ctx: AuthContext): Promise<Record<string, string>> => {\n\t\tconst entries = await Promise.all(ENV_TOKEN_NAMES.map(async (name) => [name, await ctx.env(name)] as const));\n\t\treturn Object.fromEntries(entries.filter((entry): entry is readonly [string, string] => entry[1] !== undefined));\n\t};\n\n\t/** Single predicate behind both `check` and `resolveAmbient`, so availability and resolution cannot disagree. */\n\tconst configuredFor = async (\n\t\tctx: AuthContext,\n\t\tstored: ClaudeSdkOauthCredential | undefined,\n\t\tsignal?: AbortSignal,\n\t\tenvironment?: Record<string, string>,\n\t): Promise<boolean> => {\n\t\tconst storedAccounts = stored?.type === \"oauth\" && Array.isArray(stored.accounts) ? stored.accounts : [];\n\t\tconst effectiveEnvironment = environment ?? (await claudeEnvironment(ctx));\n\t\tconst environmentTokenCount = Object.values(effectiveEnvironment).filter(Boolean).length;\n\t\tconst accountCount = storedAccounts.length + environmentTokenCount;\n\t\tconst settings = deps.readSettings?.();\n\t\tconst lane = settings?.tokenInjection ?? (accountCount > 0 ? \"oauth-slots\" : \"ambient\");\n\t\tif (lane === \"ambient\") {\n\t\t\tif (environmentTokenCount > 0) return true;\n\t\t\t// A logged-in host Claude CLI is not senpi-side consent: spending the\n\t\t\t// user's Claude subscription requires an explicit opt-in. Stored\n\t\t\t// accounts and env tokens above are opt-ins in themselves.\n\t\t\tif (settings?.enabled !== true) return false;\n\t\t\treturn (deps.readAmbientAuthStatus ?? readAmbientClaudeAuthStatus)(signal);\n\t\t}\n\t\treturn accountCount > 0;\n\t};\n\n\treturn {\n\t\tname: CLAUDE_SDK_OAUTH_NAME,\n\n\t\tasync check({ ctx, credential, signal }) {\n\t\t\tconst requestEnvironment = requestClaudeEnvironment(credential?.env);\n\t\t\treturn (await configuredFor(\n\t\t\t\tctx,\n\t\t\t\tcredential as ClaudeSdkOauthCredential | undefined,\n\t\t\t\tsignal,\n\t\t\t\tObject.keys(requestEnvironment).length > 0 ? requestEnvironment : undefined,\n\t\t\t))\n\t\t\t\t? AUTH_CHECK\n\t\t\t\t: undefined;\n\t\t},\n\n\t\tasync resolveAmbient({ ctx, env, signal }) {\n\t\t\tconst requestEnvironment = requestClaudeEnvironment(env);\n\t\t\tconst environment =\n\t\t\t\tObject.keys(requestEnvironment).length > 0 ? requestEnvironment : await claudeEnvironment(ctx);\n\t\t\tif (!(await configuredFor(ctx, undefined, signal, environment))) return undefined;\n\t\t\treturn {\n\t\t\t\tauth: { apiKey: SENTINEL_OAUTH_FIELDS.access },\n\t\t\t\t...(Object.keys(environment).length > 0 ? { env: environment } : {}),\n\t\t\t\tsource: AUTH_CHECK.source,\n\t\t\t};\n\t\t},\n\n\t\tasync login(callbacks) {\n\t\t\tconst current = (await deps.readCurrent()) ?? emptyCredential();\n\t\t\tconst existing = listAccounts(current);\n\t\t\tif (existing.length === 0 && deps.readAnthropicCredential && callbacks.onPrompt) {\n\t\t\t\tconst imported = await deps.readAnthropicCredential();\n\t\t\t\tif (imported) {\n\t\t\t\t\tconst answer = (\n\t\t\t\t\t\tawait callbacks.onPrompt({\n\t\t\t\t\t\t\tmessage: \"An Anthropic OAuth login already exists. Import it instead of a new login? [y/N]\",\n\t\t\t\t\t\t})\n\t\t\t\t\t)\n\t\t\t\t\t\t.trim()\n\t\t\t\t\t\t.toLowerCase();\n\t\t\t\t\tif (answer === \"y\" || answer === \"yes\") {\n\t\t\t\t\t\treturn addAccount(current, toSlot(imported, \"imported-anthropic\", \"import\"));\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst interaction: ProviderAuthInteraction = {\n\t\t\t\tsignal: callbacks.signal ?? new AbortController().signal,\n\t\t\t\tprompt: async (prompt) => {\n\t\t\t\t\tif (prompt.type === \"select\") return \"\";\n\t\t\t\t\treturn callbacks.onPrompt ? callbacks.onPrompt({ message: prompt.message }) : \"\";\n\t\t\t\t},\n\t\t\t\tnotify: (event) => {\n\t\t\t\t\tif (event.type === \"auth_url\" && callbacks.onAuth) void callbacks.onAuth({ url: event.url });\n\t\t\t\t\tif (event.type === \"progress\" && callbacks.onProgress) callbacks.onProgress(event.message);\n\t\t\t\t},\n\t\t\t};\n\t\t\tconst flow = deps.loginFlow ?? (await loadAnthropicOAuth());\n\t\t\tconst credential = await flow.login(interaction);\n\n\t\t\tconst existingAfter = listAccounts(current);\n\t\t\tconst name = await promptAccountName(callbacks, existingAfter);\n\t\t\treturn addAccount(current, toSlot(credential, name, \"login\"));\n\t\t},\n\n\t\tasync refreshToken(credentials) {\n\t\t\treturn credentials;\n\t\t},\n\n\t\tgetApiKey(_credentials) {\n\t\t\treturn SENTINEL_OAUTH_FIELDS.access;\n\t\t},\n\t};\n}\n"]}
+{"version":3,"file":"oauth-login.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/oauth-login.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAEN,UAAU,EAEV,eAAe,EACf,YAAY,EACZ,qBAAqB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAoChE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AACzE,MAAM,eAAe,GAAG;IACvB,yBAAyB;IACzB,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,2BAA2B,KAAK,GAAG,CAAC,EAAE,CAAC;CAC1E,CAAC;AACX,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,eAAe,CAAC,CAAC;AAC5D,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,EAAW,CAAC;AAE1E,SAAS,wBAAwB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnF,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC1F,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,SAAS,MAAM,CACd,UAAgE,EAChE,IAAY,EACZ,MAA6B;IAE7B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;AAC9G,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,SAA8B,EAAE,QAAuB;IACvF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC,SAAS,CAAC,QAAQ;QAAE,OAAO,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,CACd,MAAM,SAAS,CAAC,QAAQ,CAAC;QACxB,OAAO,EAAE,oCAAoC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC5F,WAAW,EAAE,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;KAC7C,CAAC,CACF,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,MAAM,IAAI,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAMjC;IACA,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAgB,EAAmC,EAAE;QACrF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAU,CAAC,CAAC,CAAC;QAC7G,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAsC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;IAClH,CAAC,CAAC;IAEF,iHAAiH;IACjH,MAAM,aAAa,GAAG,KAAK,EAC1B,GAAgB,EAChB,MAA4C,EAC5C,MAAoB,EACpB,WAAoC,EACjB,EAAE;QACrB,MAAM,cAAc,GAAG,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,8EAA8E;QAC9E,6EAA6E;QAC7E,MAAM,qBAAqB,GAC1B,MAAM,EAAE,IAAI,KAAK,OAAO;YACxB,MAAM,CAAC,MAAM,KAAK,qBAAqB,CAAC,MAAM;YAC9C,MAAM,CAAC,OAAO,KAAK,qBAAqB,CAAC,OAAO,CAAC;QAClD,MAAM,oBAAoB,GAAG,WAAW,IAAI,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACzF,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,qBAAqB,CAAC;QACrG,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,EAAE,cAAc,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,qBAAqB,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3C,sEAAsE;YACtE,iEAAiE;YACjE,2DAA2D;YAC3D,IAAI,QAAQ,EAAE,OAAO,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,qBAAqB,IAAI,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,YAAY,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO;QACN,IAAI,EAAE,qBAAqB;QAE3B,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE;YACtC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACrE,OAAO,CAAC,MAAM,aAAa,CAC1B,GAAG,EACH,UAAkD,EAClD,MAAM,EACN,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;gBACD,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,SAAS,CAAC;QACd,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE;YACxC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;YACzD,MAAM,WAAW,GAChB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAChG,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YAClF,OAAO;gBACN,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE;gBAC9C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,MAAM,EAAE,UAAU,CAAC,MAAM;aACzB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAS;YACpB,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,eAAe,EAAE,CAAC;YAChE,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,uBAAuB,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACtD,IAAI,QAAQ,EAAE,CAAC;oBACd,MAAM,MAAM,GAAG,CACd,MAAM,SAAS,CAAC,QAAQ,CAAC;wBACxB,OAAO,EAAE,kFAAkF;qBAC3F,CAAC,CACF;yBACC,IAAI,EAAE;yBACN,WAAW,EAAE,CAAC;oBAChB,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACxC,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;oBAC9E,CAAC;gBACF,CAAC;YACF,CAAC;YACD,MAAM,WAAW,GAA4B;gBAC5C,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM;gBACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACxB,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;wBAAE,OAAO,EAAE,CAAC;oBACxC,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,CAAC;gBACD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBACjB,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,MAAM;wBAAE,KAAK,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;oBAC7F,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,UAAU;wBAAE,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5F,CAAC;aACD,CAAC;YACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAEjD,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAC/D,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,WAAW;YAC7B,OAAO,WAAW,CAAC;QACpB,CAAC;QAED,SAAS,CAAC,YAAY;YACrB,OAAO,qBAAqB,CAAC,MAAM,CAAC;QACrC,CAAC;KACD,CAAC;AACH,CAAC","sourcesContent":["import type {\n\tAuthCheck,\n\tAuthContext,\n\tAuthResult,\n\tOAuthAuth,\n\tOAuthCredential,\n\tOAuthCredentials,\n\tProviderAuthInteraction,\n} from \"@earendil-works/pi-ai\";\nimport { loadAnthropicOAuth } from \"@earendil-works/pi-ai/oauth\";\nimport {\n\ttype AccountSlot,\n\taddAccount,\n\ttype ClaudeSdkOauthCredential,\n\temptyCredential,\n\tlistAccounts,\n\tSENTINEL_OAUTH_FIELDS,\n} from \"./accounts.ts\";\nimport { readAmbientClaudeAuthStatus } from \"./availability.ts\";\n\nexport type OAuthLoginCallbacks = {\n\tsignal?: AbortSignal;\n\tonAuth?: (event: { url: string }) => void | Promise<void>;\n\tonPrompt?: (prompt: { message: string; placeholder?: string }) => Promise<string>;\n\tonManualCodeInput?: () => Promise<string>;\n\tonProgress?: (message: string) => void;\n};\n\nexport type CurrentCredentialReader = () => Promise<ClaudeSdkOauthCredential | undefined>;\n\nexport type OAuthConfigShape = {\n\tname: string;\n\tcheck(input: {\n\t\tctx: AuthContext;\n\t\tcredential?: OAuthCredential;\n\t\tsignal?: AbortSignal;\n\t}): Promise<AuthCheck | undefined>;\n\t/**\n\t * Request auth for the ambient lane — an environment OAuth token or a\n\t * logged-in Claude CLI — used when auth.json holds no managed accounts.\n\t * The SDK subprocess authenticates itself in that lane, so the sentinel is\n\t * the whole credential; without this the provider passes `check` and then\n\t * fails every request with \"Provider is not configured\".\n\t */\n\tresolveAmbient(input: {\n\t\tctx: AuthContext;\n\t\tenv?: Record<string, string>;\n\t\tsignal?: AbortSignal;\n\t}): Promise<AuthResult | undefined>;\n\tlogin(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;\n\trefreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;\n\tgetApiKey(credentials: OAuthCredentials): string;\n};\n\nexport const CLAUDE_SDK_OAUTH_NAME = \"Claude SDK OAuth (Claude Pro/Max)\";\nconst ENV_TOKEN_NAMES = [\n\t\"CLAUDE_CODE_OAUTH_TOKEN\",\n\t...Array.from({ length: 15 }, (_, index) => `CLAUDE_CODE_OAUTH_TOKEN_${index + 2}`),\n] as const;\nconst ENV_TOKEN_NAME_SET = new Set<string>(ENV_TOKEN_NAMES);\nconst AUTH_CHECK = { source: \"Claude SDK OAuth\", type: \"oauth\" } as const;\n\nfunction requestClaudeEnvironment(value: unknown): Record<string, string> {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) return {};\n\tconst environment: Record<string, string> = {};\n\tfor (const [name, entry] of Object.entries(value)) {\n\t\tif (ENV_TOKEN_NAME_SET.has(name) && typeof entry === \"string\") environment[name] = entry;\n\t}\n\treturn environment;\n}\n\nfunction toSlot(\n\tcredential: { access: string; refresh: string; expires: number },\n\tname: string,\n\tsource: AccountSlot[\"source\"],\n): AccountSlot {\n\treturn { name, access: credential.access, refresh: credential.refresh, expires: credential.expires, source };\n}\n\nasync function promptAccountName(callbacks: OAuthLoginCallbacks, existing: AccountSlot[]): Promise<string> {\n\tif (existing.length === 0) return \"default\";\n\tif (!callbacks.onPrompt) return `account-${existing.length + 1}`;\n\tconst answer = (\n\t\tawait callbacks.onPrompt({\n\t\t\tmessage: `Name for this account (existing: ${existing.map((slot) => slot.name).join(\", \")})`,\n\t\t\tplaceholder: `account-${existing.length + 1}`,\n\t\t})\n\t).trim();\n\treturn answer || `account-${existing.length + 1}`;\n}\n\nexport function createOAuthConfig(deps: {\n\treadCurrent: CurrentCredentialReader;\n\treadAnthropicCredential?: () => Promise<{ access: string; refresh: string; expires: number } | undefined>;\n\treadAmbientAuthStatus?: (signal?: AbortSignal) => Promise<boolean>;\n\treadSettings?: () => { tokenInjection?: \"oauth-slots\" | \"config-dir\" | \"ambient\"; enabled?: boolean } | undefined;\n\tloginFlow?: OAuthAuth;\n}): OAuthConfigShape {\n\tconst claudeEnvironment = async (ctx: AuthContext): Promise<Record<string, string>> => {\n\t\tconst entries = await Promise.all(ENV_TOKEN_NAMES.map(async (name) => [name, await ctx.env(name)] as const));\n\t\treturn Object.fromEntries(entries.filter((entry): entry is readonly [string, string] => entry[1] !== undefined));\n\t};\n\n\t/** Single predicate behind both `check` and `resolveAmbient`, so availability and resolution cannot disagree. */\n\tconst configuredFor = async (\n\t\tctx: AuthContext,\n\t\tstored: ClaudeSdkOauthCredential | undefined,\n\t\tsignal?: AbortSignal,\n\t\tenvironment?: Record<string, string>,\n\t): Promise<boolean> => {\n\t\tconst storedAccounts = stored?.type === \"oauth\" && Array.isArray(stored.accounts) ? stored.accounts : [];\n\t\t// Slot-scoped resolution projects one account onto the flat credential shape,\n\t\t// stripping `accounts`; its concrete (non-sentinel) tokens are that account.\n\t\tconst selectedStoredAccount =\n\t\t\tstored?.type === \"oauth\" &&\n\t\t\tstored.access !== SENTINEL_OAUTH_FIELDS.access &&\n\t\t\tstored.refresh !== SENTINEL_OAUTH_FIELDS.refresh;\n\t\tconst effectiveEnvironment = environment ?? (await claudeEnvironment(ctx));\n\t\tconst environmentTokenCount = Object.values(effectiveEnvironment).filter(Boolean).length;\n\t\tconst accountCount = storedAccounts.length + (selectedStoredAccount ? 1 : 0) + environmentTokenCount;\n\t\tconst settings = deps.readSettings?.();\n\t\tconst lane = settings?.tokenInjection ?? (accountCount > 0 ? \"oauth-slots\" : \"ambient\");\n\t\tif (lane === \"ambient\") {\n\t\t\tif (environmentTokenCount > 0) return true;\n\t\t\t// A logged-in host Claude CLI is not senpi-side consent: spending the\n\t\t\t// user's Claude subscription requires an explicit opt-in. Stored\n\t\t\t// accounts and env tokens above are opt-ins in themselves.\n\t\t\tif (settings?.enabled !== true) return false;\n\t\t\treturn (deps.readAmbientAuthStatus ?? readAmbientClaudeAuthStatus)(signal);\n\t\t}\n\t\treturn accountCount > 0;\n\t};\n\n\treturn {\n\t\tname: CLAUDE_SDK_OAUTH_NAME,\n\n\t\tasync check({ ctx, credential, signal }) {\n\t\t\tconst requestEnvironment = requestClaudeEnvironment(credential?.env);\n\t\t\treturn (await configuredFor(\n\t\t\t\tctx,\n\t\t\t\tcredential as ClaudeSdkOauthCredential | undefined,\n\t\t\t\tsignal,\n\t\t\t\tObject.keys(requestEnvironment).length > 0 ? requestEnvironment : undefined,\n\t\t\t))\n\t\t\t\t? AUTH_CHECK\n\t\t\t\t: undefined;\n\t\t},\n\n\t\tasync resolveAmbient({ ctx, env, signal }) {\n\t\t\tconst requestEnvironment = requestClaudeEnvironment(env);\n\t\t\tconst environment =\n\t\t\t\tObject.keys(requestEnvironment).length > 0 ? requestEnvironment : await claudeEnvironment(ctx);\n\t\t\tif (!(await configuredFor(ctx, undefined, signal, environment))) return undefined;\n\t\t\treturn {\n\t\t\t\tauth: { apiKey: SENTINEL_OAUTH_FIELDS.access },\n\t\t\t\t...(Object.keys(environment).length > 0 ? { env: environment } : {}),\n\t\t\t\tsource: AUTH_CHECK.source,\n\t\t\t};\n\t\t},\n\n\t\tasync login(callbacks) {\n\t\t\tconst current = (await deps.readCurrent()) ?? emptyCredential();\n\t\t\tconst existing = listAccounts(current);\n\t\t\tif (existing.length === 0 && deps.readAnthropicCredential && callbacks.onPrompt) {\n\t\t\t\tconst imported = await deps.readAnthropicCredential();\n\t\t\t\tif (imported) {\n\t\t\t\t\tconst answer = (\n\t\t\t\t\t\tawait callbacks.onPrompt({\n\t\t\t\t\t\t\tmessage: \"An Anthropic OAuth login already exists. Import it instead of a new login? [y/N]\",\n\t\t\t\t\t\t})\n\t\t\t\t\t)\n\t\t\t\t\t\t.trim()\n\t\t\t\t\t\t.toLowerCase();\n\t\t\t\t\tif (answer === \"y\" || answer === \"yes\") {\n\t\t\t\t\t\treturn addAccount(current, toSlot(imported, \"imported-anthropic\", \"import\"));\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst interaction: ProviderAuthInteraction = {\n\t\t\t\tsignal: callbacks.signal ?? new AbortController().signal,\n\t\t\t\tprompt: async (prompt) => {\n\t\t\t\t\tif (prompt.type === \"select\") return \"\";\n\t\t\t\t\treturn callbacks.onPrompt ? callbacks.onPrompt({ message: prompt.message }) : \"\";\n\t\t\t\t},\n\t\t\t\tnotify: (event) => {\n\t\t\t\t\tif (event.type === \"auth_url\" && callbacks.onAuth) void callbacks.onAuth({ url: event.url });\n\t\t\t\t\tif (event.type === \"progress\" && callbacks.onProgress) callbacks.onProgress(event.message);\n\t\t\t\t},\n\t\t\t};\n\t\t\tconst flow = deps.loginFlow ?? (await loadAnthropicOAuth());\n\t\t\tconst credential = await flow.login(interaction);\n\n\t\t\tconst existingAfter = listAccounts(current);\n\t\t\tconst name = await promptAccountName(callbacks, existingAfter);\n\t\t\treturn addAccount(current, toSlot(credential, name, \"login\"));\n\t\t},\n\n\t\tasync refreshToken(credentials) {\n\t\t\treturn credentials;\n\t\t},\n\n\t\tgetApiKey(_credentials) {\n\t\t\treturn SENTINEL_OAUTH_FIELDS.access;\n\t\t},\n\t};\n}\n"]}